Ondřej Caletka. November 2015
|
|
|
- Miranda Simmons
- 6 years ago
- Views:
Transcription
1 A measurement of SMTP over TLS Ondřej Caletka November 2015 Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
2 The principle SMTP To: From Dear Bob 1 To: bob@borg From alice@aorg Dear Bob 5 Alice's MUA SMTP To: bob@borg From: alice@aorg POP3 4 Bob's MUA Dear Bob smtpaorg The Internet SMTP mxborg pop3borg mxborg 3 MX for borg? 2 DNS DNS nsborg Yzmo at the English language Wikipedia CC-BY-SA 30 Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
3 Who s possibly reading? sender s server recipient s server anybody taping the wire Best Current Practice #188 Internet Engineering Task Force (IETF) S Farrell Request for Comments: 7258 Trinity College Dublin BCP: 188 H Tschofenig Category: Best Current Practice ARM Ltd ISSN: May 2014 Abstract Pervasive Monitoring Is an Attack Pervasive monitoring is a technical attack that should be mitigated in the design of IETF protocols, where possible Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
4 Oportunistic encryption server announces support for STARTTLS client opens anonymous TLS no identity check old and broken ciphers are allowed if TLS fails plain-text is used only against passive taping Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
5 Opt-in for security server certificate fingerprint stored in secure DNS already standardised in RFC 7672 presence of TLSA record states: Hey, don t you ever try to deliver via plaintext to me! I do offer modest security! Example _25_tcpmxexamplecom IN TLSA AA793DA Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
6 Testing with posttls-finger Without TLSA record Untrusted $ /usr/sbin/posttls-finger -c gmailcom posttls-finger: gmail-smtp-inlgooglecom[2a00:1450:4013:c01::1a]:25: Matched subjectaltname: gmail-smtp-inlgooglecom posttls-finger: mx1seznamcz:25: Matched subjectaltname: mx1seznamcz posttls-finger: certificate verification failed for gmail-smtp-inlgoogle com[2a00:1450:4013:c01::1a]:25: untrusted issuer /C=US/O=Equifax/OU=Equifax Secure Certificate Authority posttls-finger: Untrusted TLS connection established to gmail-smtp-inl googlecom[2a00:1450:4013:c01::1a]:25: TLSv12 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits) With TLSA record Verified $ /usr/sbin/posttls-finger -c cesnetcz posttls-finger: using DANE RR: _25_tcp IN TLSA C:42:8B:01:3B:2E:3F:0D:30 posttls-finger: postinocesnetcz:25: depth=1 matched trust anchor certificate sha256 digest 5C:42:8B:01:3B:2E:3F:0D:30 posttls-finger: Verified TLS connection established to postinocesnetcz:25: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits) Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
7 SMTP-over-TLS measurement on domain names collected from our server Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
8 DNSSEC for MX record DNSSEC 21,7% No DNSSEC 78,3% Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
9 STARTTLS support on servers TLSA verified 1,1% 1168 No TLS support 25,3% TLS supported 73,6% 3400 Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
10 SMTP certificate types Self- Signed 14,1% Untrusted issuer 17,2% Trusted without matching name 7,9% Verified by domain name 13,1% Verified by server name 47,6% Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
11 TLSA Hall of Fame Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
12 Conclusion enable STARTTLS support on your MX servers virtually no cost self-signed certificate is OK there s no secure without DNSSEC once DNSSEC is deployed, TLSA records cost nothing check your domain at it is safe to validate TLSA records but better check the logs for errors like Server certificate not trusted Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
13 Thank You! Ondřej Caletka Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November / 13
DANE/DNSSEC/TLS Testing in the Go6lab. Jan Žorž, Internet Society
DANE/DNSSEC/TLS Testing in the Go6lab Jan Žorž, Internet Society zorz@isoc.org Acknowledgement I would like to thank Internet Society to let me spend some of my ISOC working time in go6lab and test all
DANE Best Current Practice
DANE Best Current Practice draft-dukhovni-dane-ops-01 Viktor Dukhovni & Wes Hardaker IETF 87, Berlin July 2013 General DANE Guidelines (Type Independent) Large DNS payload issues Issues with large UDP
SMTP [in]security. Ian Foster Jon Larson
![SMTP [in]security. Ian Foster Jon Larson](/thumbs/74/70659467.jpg "SMTP [in]security. Ian Foster Jon Larson")
SMTP [in]security Ian Foster Jon Larson Goals 1. Does the global email system currently provide security against passive adversary (eavesdropper)? 2. Against an active adversary (man in the middle)? Brief
DANE/DNSSEC/TLS Tes-ng in the Go6lab. Jan Žorž, ISOC/Go6 Ins-tute, Slovenia
DANE/DNSSEC/TLS Tes-ng in the Go6lab Jan Žorž, ISOC/Go6 Ins-tute, Slovenia jan@go6.si zorz@isoc.org Acknowledgement I would like to thank Internet Society to let me spend some of my ISOC working -me in
Ecosystem at Large
Testing TLS in the E-mail Ecosystem at Large IT-SeCX 2015 Wilfried Mayer, Aaron Zauner, Martin Schmiedecker, Markus Huber Overview Background Methodology Results Mitigation 2 Background Transport Layer
No Need for Black Chambers
No Need for Black Chambers Testing TLS in the E-mail Ecosystem at Large Wilfried Mayer, Aaron Zauner, Martin Mulazzani, Markus Huber (FH St-Poelten) Overview Background Methodology Results Abuse-handling
Comprehensive Setup Guide for TLS on ESA
Comprehensive Setup Guide for TLS on ESA Contents Introduction Prerequisites Requirements Components Used Background Information Functional Overview and Requirements Bring Your Own Certificate Update a
DANE/DNSSEC/TLS Tes-ng in the Go6lab. Jan Žorž, ISOC/Go6 Ins-tute, Slovenia
DANE/DNSSEC/TLS Tes-ng in the Go6lab Jan Žorž, ISOC/Go6 Ins-tute, Slovenia jan@go6.si zorz@isoc.org Acknowledgement I would like to thank Internet Society to let me spend some of my ISOC working -me in
Innovative uses as result of DNSSEC
Innovative uses as result of DNSSEC AKA: Some happenings in the DANE* WG in the IETF. * DNS-based Authentication of Named Entities Some background... When you connect to https://www.example.com you use
How to Configure SSL Interception in the Firewall
Most applications encrypt outgoing connections with SSL or TLS. SSL Interception decrypts SSL-encrypted HTTPS and SMTPS traffic to allow Application Control features (such as the Virus Scanner, ATP, URL
DANE Demonstration! Duane Wessels, Verisign! ICANN 49 DNSSEC Workshop! March 26, 2014!
DANE Demonstration! Duane Wessels, Verisign! ICANN 49 DNSSEC Workshop! March 26, 2014! Outline! What is DANE?! The TLSA Record! TLSA Browser Plugin! Generating the TLSA Record! Other uses for DANE! 2!
DANE, why we need it. Daniel Stirnimann Bern, 29. March SWITCH 1
DANE, why we need it Daniel Stirnimann daniel.stirnimann@switch.ch Bern, 29. March 2017 2017 SWITCH 1 Why do we trust this website? 2017 SWITCH 2 Why do we trust this website? 1. DNS lookup for www.credit-suisse.com
Introduction to the DANE Protocol
Introduction to the DANE Protocol ICANN 46 April 10, 2013 Internet Society Deploy360 Programme Providing real-world deployment info for IPv6, DNSSEC and other Internet technologies: Case Studies Tutorials
Real World DANE Inter-domain transport. Viktor Dukhovni
Real World DANE Inter-domain email transport Viktor Dukhovni Overview 1. Background 2. DANE if you don't (DNSSEC hygiene) 3. DANE if you do (plan, automate, monitor) 4. DANE survey
Secure the connections of mail servers
Secure the connections of mail servers STARTTLS and DANE protect email traffic on the internet Factsheet FS-2017-01 version 1.1 4 April 2017 Traditionally, connections between mail servers have hardly
CS Computer Networks 1: Authentication
CS 3251- Computer Networks 1: Authentication Professor Patrick Traynor 4/14/11 Lecture 25 Announcements Homework 3 is due next class. Submit via T-Square or in person. Project 3 has been graded. Scores
CS 356 Internet Security Protocols. Fall 2013
CS 356 Internet Security Protocols Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5
Introduction to the DANE Protocol And Updates From IETF 88
Introduction to the DANE Protocol And Updates From IETF 88 Dan York, Senior Content Strategist Internet Society ICANN 48, Buenos Aires, Argentina November 20, 2013 A Quick Overview of DANE www.internetsociety.org
Extensions to ACME for (TLS, S/MIME)
Extensions to ACME for email (TLS, S/MIME) draft-ietf-acme-email-tls-02 draft-ietf-acme-email-smime-01 Alexey Melnikov, Isode Ltd 1 Changes in draft-ietf-acme-emailtls-02 since Prague Removed TLS SNI challenge,
Verify certificate chain with OpenSSL
Verify certificate chain with OpenSSL 1 / 5 Author : Tobias Hofmann Date : February 18, 2016 A good TLS setup includes providing a complete certificate chain to your clients. This means that your web server
Let s Encrypt and DANE
Let s Encrypt and DANE CaribNOG 13 Barbados 18 Apr 2017 The Deploy360 Programme The Challenge: The IETF creates protocols based on open standards, but some are not widely known or deployed People seeking
FUJITSU Software BS2000 internet Services. Version 3.4A May Readme
FUJITSU Software BS2000 internet Services Version 3.4A May 2016 Readme All rights reserved, including intellectual property rights. Technical data subject to modifications and delivery subject to availability.
Internet Engineering Task Force (IETF) Request for Comments: 7817 Updates: 2595, 3207, 3501, 5804 March 2016 Category: Standards Track ISSN:
Internet Engineering Task Force (IETF) A. Melnikov Request for Comments: 7817 Isode Ltd Updates: 2595, 3207, 3501, 5804 March 2016 Category: Standards Track ISSN: 2070-1721 Updated Transport Layer Security
TLS in the wild. An Internet-wide analysis of TLS-based protocols for electronic communication. Ralph Holz
TLS in the wild An Internet-wide analysis of TLS-based protocols for electronic communication Ralph Holz School of Information Technologies Faculty of Engineering & Information Technologies Team This is
Encryption. INST 346, Section 0201 April 3, 2018
Encryption INST 346, Section 0201 April 3, 2018 Goals for Today Symmetric Key Encryption Public Key Encryption Certificate Authorities Secure Sockets Layer Simple encryption scheme substitution cipher:
Internet Engineering Task Force (IETF) Request for Comments: 6594 Category: Standards Track April 2012 ISSN:
Internet Engineering Task Force (IETF) O. Sury Request for Comments: 6594 CZ.NIC Category: Standards Track April 2012 ISSN: 2070-1721 Abstract Use of the SHA-256 Algorithm with RSA, Digital Signature Algorithm
About FIPS, NGE, and AnyConnect
About FIPS, NGE, and AnyConnect, on page 1 Configure FIPS for the AnyConnect Core VPN Client, on page 4 Configure FIPS for the Network Access Manager, on page 5 About FIPS, NGE, and AnyConnect AnyConnect
1) Revision history Revision 0 (Oct 29, 2008) First revision (r0)
To: INCITS Technical Committee T10 From: David L. Black, EMC Email: black_david@emc.com Date: October 29, 2008 Subject: SPC-4: Digital Signature Authentication (08-423r0) 1) Revision history Revision 0
Internet Engineering Task Force (IETF) Request for Comments: 7435 Category: Informational December 2014 ISSN:
Internet Engineering Task Force (IETF) V. Dukhovni Request for Comments: 7435 Two Sigma Category: Informational December 2014 ISSN: 2070-1721 Abstract Opportunistic Security: Some Protection Most of the
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ Chapter 8 Network Security Computer Networking: A Top Down Approach, 5 th edition. Jim Kurose, Keith Ross Addison-Wesley, April 2009.
Internet Engineering Task Force. Intended status: Standards Track February 13, 2017 Expires: August 17, 2017
Internet Engineering Task Force J. Fenton Internet-Draft Altmode Networks Intended status: Standards Track February 13, 2017 Expires: August 17, 2017 Abstract SMTP Require TLS Option draft-fenton-smtp-require-tls-03
CSCE 813 Internet Security Secure Services I
CSCE 813 Internet Security Secure E-Mail Services I Professor Lisa Luo Fall 2017 Previous Class Why do we need cloud computing? Three models of cloud service Software as a service (SaaS) Platform as a
Lecture 9a: Secure Sockets Layer (SSL) March, 2004
Internet and Intranet Protocols and Applications Lecture 9a: Secure Sockets Layer (SSL) March, 2004 Arthur Goldberg Computer Science Department New York University artg@cs.nyu.edu Security Achieved by
Computer Networking. What is network security? Chapter 7: Network security. Symmetric key cryptography. The language of cryptography
Chapter 7: Network security 15-441 Computer Networking Network Security: Cryptography, Authentication, Integrity Foundations: what is security? cryptography authentication message integrity key distribution
CS 161 Computer Security
Popa & Wagner Spring 2016 CS 161 Computer Security Midterm 2 Print your name:, (last) (first) I am aware of the Berkeley Campus Code of Student Conduct and acknowledge that academic misconduct will be
WHITE PAPER. Authentication and Encryption Design
WHITE PAPER Authentication and Encryption Design Table of Contents Introduction Applications and Services Account Creation Two-step Verification Authentication Passphrase Management Email Message Encryption
Lotus Protector Interop Guide. Mail Encryption Mail Security Version 1.4
Lotus Protector Mail Security and Mail Encryption Interop Guide Lotus Protector Interop Guide Mail Encryption 2.1.0.1 Mail Security 2.5.1 Version 1.4 Lotus Protector Mail Security and Mail Encryption Configuration
DNS and SMTP. James Walden CIT 485: Advanced Cybersecurity. James WaldenCIT 485: Advanced Cybersecurity DNS and SMTP 1 / 31
DNS and SMTP James Walden CIT 485: Advanced Cybersecurity James WaldenCIT 485: Advanced Cybersecurity DNS and SMTP 1 / 31 Table of contents 1. DNS 2. DNS Protocol Packets 3. DNS Caching 4. DNS Cache Poisoning
Internet Engineering Task Force (IETF) Request for Comments: Category: Standards Track ISSN: October 2015
Internet Engineering Task Force (IETF) V. Dukhovni Request for Comments: 7671 Two Sigma Updates: 6698 W. Hardaker Category: Standards Track Parsons ISSN: 2070-1721 October 2015 The DNS-Based Authentication
Internet Engineering Task Force (IETF) Category: Informational October 2011 ISSN:
Internet Engineering Task Force (IETF) R. Barnes Request for Comments: 6394 BBN Technologies Category: Informational October 2011 ISSN: 2070-1721 Abstract Use Cases and Requirements for DNS-Based Authentication
Using SRP for TLS Authentication
Using SRP for TLS Authentication Internet Draft Transport Layer Security Working Group D. Taylor Forge Research Pty Ltd Expires: March 5, 2003 September 4, 2002 Using SRP for TLS Authentication draft-ietf-tls-srp-03
Ref:
Cryptography & digital signature Dec. 2013 Ref: http://cis.poly.edu/~ross/ 2 Cryptography Overview Symmetric Key Cryptography Public Key Cryptography Message integrity and digital signatures References:
BEST PRACTICES FOR PERSONAL Security
BEST PRACTICES FOR PERSONAL Email Security Sometimes it feels that the world of email and internet communication is fraught with dangers: malware, viruses, cyber attacks and so on. There are some simple
Anonymity. Assumption: If we know IP address, we know identity
03--4 Anonymity Some degree of anonymity from using pseudonyms However, anonymity is always limited by address TCP will reveal your address address together with ISP cooperation Anonymity is broken We
Chapter 8 Web Security
Chapter 8 Web Security Web security includes three parts: security of server, security of client, and network traffic security between a browser and a server. Security of server and security of client
Request for Comments: J. Salowey, Ed. Cisco Systems, Inc. March Transport Layer Security (TLS) Transport Mapping for Syslog
Network Working Group Request for Comments: 5425 Category: Standards Track F. Miao, Ed. Y. Ma, Ed. Huawei Technologies J. Salowey, Ed. Cisco Systems, Inc. March 2009 Transport Layer Security (TLS) Transport
A SIMPLE INTRODUCTION TO TOR
A SIMPLE INTRODUCTION TO TOR The Onion Router Fabrizio d'amore May 2015 Tor 2 Privacy on Public Networks Internet is designed as a public network Wi-Fi access points, network routers see all traffic that
Internet Engineering Task Force (IETF) Category: Best Current Practice ISSN: May 2014
Internet Engineering Task Force (IETF) S. Farrell Request for Comments: 7258 Trinity College Dublin BCP: 188 H. Tschofenig Category: Best Current Practice ARM Ltd. ISSN: 2070-1721 May 2014 Abstract Pervasive
How to get a trustworthy DNS Privacy enabling recursive resolver
How to get a trustworthy DNS an analysis of authentication mechanisms for DNS s Willem Toorop NLnet Labs (presenter) Melinda Shore Fastly Benno Overeinder NLnet Labs DNS over TLS What are the actors, and
Designing Network Encryption for the Future Emily McAdams Security Engagement Manager, Security & Trust Organization BRKSEC-2015
Designing Network Encryption for the Future Emily McAdams Security Engagement Manager, Security & Trust Organization BRKSEC-2015 What Could It Cost You? Average of $0.58 a record According to the Verizon
Transport Layer Security
Transport Layer Security TRANSPORT LAYER SECURITY PERFORMANCE TESTING OVERVIEW Transport Layer Security (TLS) and its predecessor Secure Sockets Layer (SSL), are the most popular cryptographic protocols
Network Security Chapter 8
Network Security Chapter 8 Cryptography Symmetric-Key Algorithms Public-Key Algorithms Digital Signatures Management of Public Keys Communication Security Authentication Protocols Email Security Web Security
1.264 Lecture 28. Cryptography: Asymmetric keys
1.264 Lecture 28 Cryptography: Asymmetric keys Next class: Anderson chapters 20. Exercise due before class (Reading doesn t cover same topics as lecture) 1 Asymmetric or public key encryption Receiver
Information Security CS 526
Information Security CS 526 Topic 14: Key Distribution & Agreement, Secure Communication Topic 14: Secure Communication 1 Readings for This Lecture On Wikipedia Needham-Schroeder protocol (only the symmetric
Internet Engineering Task Force (IETF) Request for Comments: 7192 Category: Standards Track April 2014 ISSN:
Internet Engineering Task Force (IETF) S. Turner Request for Comments: 7192 IECA Category: Standards Track April 2014 ISSN: 2070-1721 Abstract Algorithms for Cryptographic Message Syntax (CMS) Key Package
Internet Engineering Task Force. Intended status: Standards Track November 20, 2018 Expires: May 24, 2019
Internet Engineering Task Force J. Fenton Internet-Draft Altmode Networks Intended status: Standards Track November 20, 2018 Expires: May 24, 2019 Abstract SMTP Require TLS Option draft-ietf-uta-smtp-require-tls-05
Experiment No: Group A-6
R (2) N (5) Oral (3) Total (10) Dated Sign Experiment No: Group A-6 Problem Definition: Write a program in C++ /Python to analyze email header. 6.1Prerequisite: Application Layer Protocols 6.2 Learning
Refresher: Applied Cryptography
Refresher: Applied Cryptography (emphasis on common tools for secure processors) Chris Fletcher Fall 2017, 598 CLF, UIUC Complementary reading Intel SGX Explained (ISE) Victor Costan, Srini Devadas https://eprint.iacr.org/2016/086.pdf
Scan Results - ( Essentials - Onsharp )
Scan Results - www.onsharp.com ( Essentials - Onsharp ) Overview Open Ports (18) Scan ID: 7675527 Target: www.onsharp.com Max Score: 2.6 Compliance: Passing PCI compliance, Expires undefined Profile: 15
14. Internet Security (J. Kurose)
14. Internet Security (J. Kurose) 1 Network security Foundations: what is security? cryptography authentication message integrity key distribution and certification Security in practice: application layer:
TLS 1.1 Security fixes and TLS extensions RFC4346
F5 Networks, Inc 2 SSL1 and SSL2 Created by Netscape and contained significant flaws SSL3 Created by Netscape to address SSL2 flaws TLS 1.0 Standardized SSL3 with almost no changes RFC2246 TLS 1.1 Security
SharkFest 17 Europe. SSL/TLS Decryption. uncovering secrets. Wednesday November 8th, Peter Wu Wireshark Core Developer
SharkFest 17 Europe SSL/TLS Decryption uncovering secrets Wednesday November 8th, 2017 Peter Wu Wireshark Core Developer peter@lekensteyn.nl 1 About me Wireshark contributor since 2013, core developer
APNIC elearning: Cryptography Basics
APNIC elearning: Cryptography Basics 27 MAY 2015 03:00 PM AEST Brisbane (UTC+10) Issue Date: Revision: Introduction Presenter Sheryl Hermoso Training Officer sheryl@apnic.net Specialties: Network Security
October 4, 2000 Expires in six months. SMTP Service Extension for Secure SMTP over TLS. Status of this Memo
Internet Draft draft-hoffman-rfc2487bis-04.txt October 4, 2000 Expires in six months Paul Hoffman Internet Mail Consortium Status of this Memo SMTP Service Extension for Secure SMTP over TLS This document
SSH SECURITY. If you ve never used SSH before on a computer, the chances are very high that
SSH SECURITY If you ve never used SSH before on a computer, the chances are very high that when you tried to play along with the previous section you encountered a strange notification that may have looked
Five Years of DANE Modern, Secure and Stress-free SMTP
Five Years of DANE Modern, Secure and Stress-free SMTP Most of the time we send email encrypted to destinations we probably know. Most of the time? We probably know? Clients don t know a server can encrypt
Kurose & Ross, Chapters (5 th ed.)
Kurose & Ross, Chapters 8.2-8.3 (5 th ed.) Slides adapted from: J. Kurose & K. Ross \ Computer Networking: A Top Down Approach (5 th ed.) Addison-Wesley, April 2009. Copyright 1996-2010, J.F Kurose and
Introduction and Overview. Why CSCI 454/554?
Introduction and Overview CSCI 454/554 Why CSCI 454/554? Get Credits and Graduate Security is important More job opportunities More research funds 1 Workload Five homework assignments Two exams (open book
Internet and Intranet Protocols and Applications
Internet and Intranet Protocols and Applications Lecture 10: Internet and Network Security April 9, 2003 Arthur Goldberg Computer Science Department New York University artg@cs.nyu.edu What is network
Internet Engineering Task Force (IETF) Request for Comments: Category: Informational ISSN: January 2010
Internet Engineering Task Force (IETF) S. Turner Request for Comments: 5753 IECA Obsoletes: 3278 D. Brown Category: Informational Certicom ISSN: 2070-1721 January 2010 Abstract Use of Elliptic Curve Cryptography
CSE 127: Computer Security Cryptography. Kirill Levchenko
CSE 127: Computer Security Cryptography Kirill Levchenko October 24, 2017 Motivation Two parties want to communicate securely Secrecy: No one else can read messages Integrity: messages cannot be modified
Cryptography and Network Security
Cryptography and Network Security Spring 2012 http://users.abo.fi/ipetre/crypto/ Lecture 14: Folklore, Course summary, Exam requirements Ion Petre Department of IT, Åbo Akademi University 1 Folklore on
Intended status: Informational October 27, 2014 Expires: April 30, 2015
Network Working Group J. Mattsson Internet-Draft Ericsson Intended status: Informational October 27, 2014 Expires: April 30, 2015 Abstract Overview and Analysis of Overhead Caused by TLS draft-mattsson-uta-tls-overhead-01
draft-harkins-tls-pwd Dan Harkins Aruba Networks
draft-harkins-tls-pwd Dan Harkins Aruba Networks What? Certificate-less ciphersuites, more secure than PSK Instantiates a PAKE protocol called dragonfly Authentication using a password Resistance to off-line
Concrete cryptographic security in F*
Concrete cryptographic security in F* crypto hash (SHA3) INT-CMA encrypt then-mac Auth. encryption Secure RPC some some some adversary attack attack symmetric encryption (AES). IND-CMA, CCA2 secure channels
SECURITY IN NETWORKS
SECURITY IN NETWORKS GOALS Understand principles of network security: Cryptography and its many uses beyond con dentiality Authentication Message integrity WHAT IS NETWORK SECURITY? Con dentiality: only
DNS security extensions
DNS security extensions ENOG IV / RIPE NCC Regional Meeting 23 24 October 2012, Moscow Security related RR CERT TLSA, SMIMEA* (DANE) CAA* SSHFP SPF PKIX problems Self-signed certificates (~48% web servers)
Category: Standards Track January 1999
Network Working Group P. Hoffman Request for Comments: 2487 Internet Mail Consortium Category: Standards Track January 1999 Status of this Memo SMTP Service Extension for Secure SMTP over TLS This document
SSL/TLS & 3D Secure. CS 470 Introduction to Applied Cryptography. Ali Aydın Selçuk. CS470, A.A.Selçuk SSL/TLS & 3DSec 1
SSL/TLS & 3D Secure CS 470 Introduction to Applied Cryptography Ali Aydın Selçuk CS470, A.A.Selçuk SSL/TLS & 3DSec 1 SSLv2 Brief History of SSL/TLS Released in 1995 with Netscape 1.1 Key generation algorithm
Internet Engineering Task Force (IETF) Request for Comments: 6160 Category: Standards Track April 2011 ISSN:
Internet Engineering Task Force (IETF) S. Turner Request for Comments: 6160 IECA Category: Standards Track April 2011 ISSN: 2070-1721 Abstract Algorithms for Cryptographic Message Syntax (CMS) Protection
Cryptographic Mechanisms: Recommendations and Key Lengths
Technical Guideline TR-02102-4 Cryptographic Mechanisms: Recommendations and Key Lengths Part 4 Use of Secure Shell (SSH) (Version 2018-01) Federal Office for Information Security P.O.B. 20 03 63 D-53133
ח'/סיון/תשע "א. RSA: getting ready. Public Key Cryptography. Public key cryptography. Public key encryption algorithms
Public Key Cryptography Kurose & Ross, Chapters 8.28.3 (5 th ed.) Slides adapted from: J. Kurose & K. Ross \ Computer Networking: A Top Down Approach (5 th ed.) AddisonWesley, April 2009. Copyright 19962010,
E-commerce security: SSL/TLS, SET and others. 4.1
E-commerce security: SSL/TLS, SET and others. 4.1 1 Electronic payment systems Purpose: facilitate the safe and secure transfer of monetary value electronically between multiple parties Participating parties:
SECURITY IN NETWORKS 1
SECURITY IN NETWORKS 1 GOALS Understand principles of network security: Cryptography and its many uses beyond con dentiality Authentication Message integrity 2. 1 WHAT IS NETWORK SECURITY? Con dentiality:
Building Security at Scale. PRESENTED BY Alex Stamos Black Hat USA 2014 August 7, 2014
Building Security at Scale PRESENTED BY Alex Stamos Black Hat USA 2014 August 7, 2014 Agenda The Security Industry and Web Scale Problems Combating Security Nihilism What is Yahoo doing about it? 2 Theses
32c3. December 28, Nick https://crypto.dance. goto fail;
32c3 December 28, 2015 Nick Sullivan @grittygrease nick@cloudflare.com https://crypto.dance goto fail; a compendium of transport security calamities Broken Key 2 Lock 3 Lock 4 5 6 HTTP HTTPS The S stands
Understand the TLS handshake Understand client/server authentication in TLS. Understand session resumption Understand the limitations of TLS
Last Updated: Oct 31, 2017 Understand the TLS handshake Understand client/server authentication in TLS RSA key exchange DHE key exchange Explain certificate ownership proofs in detail What cryptographic
PROTECTING CONVERSATIONS
PROTECTING CONVERSATIONS Basics of Encrypted Network Communications Naïve Conversations Captured messages could be read by anyone Cannot be sure who sent the message you are reading Basic Definitions Authentication
Securing, Protecting, and Managing the Flow of Corporate Communications
Securing, Protecting, and Managing the Flow of Corporate Communications Getting mailflow right Dave Stork Technical Consultant OGD ict-diensten QR: URL to Presentation Who am I? Dave Stork Technical consultant
Requirements from the. Functional Package for Transport Layer Security (TLS)
Requirements from the Functional Package for Transport Layer Security (TLS) Version: 1.0 2018-12-17 National Information Assurance Partnership Revision History Version Date Comment Introduction Purpose.
TLS1.2 IS DEAD BE READY FOR TLS1.3
TLS1.2 IS DEAD BE READY FOR TLS1.3 28 March 2017 Enterprise Architecture Technology & Operations Presenter Photo Motaz Alturayef Jubial Cyber Security Conference 70% Privacy and security concerns are
ExtraHop 7.0 ExtraHop Trace Admin UI Guide
ExtraHop 7.0 ExtraHop Trace Admin UI Guide 2018 ExtraHop Networks, Inc. All rights reserved. This manual in whole or in part, may not be reproduced, translated, or reduced to any machinereadable form without
Security by Any Other Name:
Security by Any Other Name: On the Effectiveness of Provider Based Email Security Ian Foster, Jon Larson, Max Masich, Alex C. Snoeren, Stefan Savage, and Kirill Levchenko University of California, San
Bolt on some Crypto. Michael Ruxcon 2014
Bolt on some Crypto Michael Samuel @mik235 https://miknet.net/ Ruxcon 2014 Securing The Network - TLS & SSH IETF Standards: SSH - RFC 4250-4255 Remote shell File transfer TCP port forwarding, socks proxy
Instructions Eudora OSE Page 1
Instructions Eudora OSE Page 1 Instructions Eudora OSE This manual is written for users who already have an e-mail account configured in Eudora OSE and will therefore only focus on how to change the SMTP
CPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 24a December 2, 2013 CPSC 467, Lecture 24a 1/20 Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management and Trusted
06/02/ Local & Metropolitan Area Networks. 0. Overview. Terminology ACOE322. Lecture 8 Network Security
1 Local & Metropolitan Area Networks ACOE322 Lecture 8 Network Security Dr. L. Christofi 1 0. Overview As the knowledge of computer networking and protocols has become more widespread, so the threat of
Securely Deploying TLS 1.3. September 2017
Securely Deploying TLS 1.3 September 2017 Agenda Why TLS 1.3? Zero Round Trip Time (0-RTT) requests Forward secrecy Resumption key management Why TLS 1.3? Speed TLS impacts latency, not thoroughput Protocol
Security: Cryptography
Security: Cryptography Computer Science and Engineering College of Engineering The Ohio State University Lecture 38 Some High-Level Goals Confidentiality Non-authorized users have limited access Integrity
Internet security and privacy
Internet security and privacy SSL/TLS 1 Application layer App. TCP/UDP IP L2 L1 2 Application layer App. SSL/TLS TCP/UDP IP L2 L1 3 History of SSL/TLS Originally, SSL Secure Socket Layer, was developed