Your Apps and Evolving Network Security Standards
|
|
|
- Solomon McDowell
- 5 years ago
- Views:
Transcription
1 Session System Frameworks #WWDC17 Your Apps and Evolving Network Security Standards 701 Bailey Basile, Secure Transports Engineer Chris Wood, Secure Transports Engineer 2017 Apple Inc. All rights reserved. Redistribution or public display not permitted without written permission from Apple.
2 BEAST FREAK CRIME POODLE Sweet32 SLOTH LogJam FLAME SHAttered Lucky13 Mis-issuance NOMORE Factoring BREACH DROWN 3HS
3 BEAST FREAK CRIME POODLE Sweet32 SLOTH LogJam FLAME SHAttered Lucky13 NOMORE Factoring BREACH DROWN Mis-issuance 3HS
4 Best practices
5 Best practices App Transport Security update
6 Best practices App Transport Security update Transport Layer Security
7 Best Practices
8 Best Practices
9 Best Practices No set and forget
10 Best Practices No set and forget Standards bodies, academic research, and industry best practices
11 Best Practices No set and forget Standards bodies, academic research, and industry best practices Update libraries
12 Best Practices No set and forget Standards bodies, academic research, and industry best practices Update libraries OS removes insecure options
13 Best Practices No set and forget Standards bodies, academic research, and industry best practices Update libraries OS removes insecure options ATS enforces best practices
14 Best Practices No set and forget Standards bodies, academic research, and industry best practices Update libraries OS removes insecure options ATS enforces best practices Worth the maintenance cost
15 Best Practices BEAST FREAK CRIME POODLE Sweet32 SLOTH NOMORE FLAME SHAttered Lucky13 LogJam Factoring BREACH DROWN Mis-issuance 3HS
16 Best Practices Encryption BEAST FREAK CRIME POODLE Sweet32 SLOTH NOMORE FLAME SHAttered Lucky13 LogJam Factoring BREACH DROWN Mis-issuance 3HS
17 Best Practices Encryption BEAST FREAK CRIME POODLE Cryptographic hashes Sweet32 SLOTH NOMORE FLAME SHAttered Lucky13 LogJam Factoring BREACH DROWN Mis-issuance 3HS
18 Best Practices Encryption BEAST FREAK CRIME POODLE Cryptographic hashes Sweet32 SLOTH NOMORE FLAME Public keys SHAttered Lucky13 LogJam Factoring BREACH DROWN Mis-issuance 3HS
19 Best Practices Encryption BEAST FREAK CRIME POODLE Cryptographic hashes Sweet32 SLOTH NOMORE FLAME Public keys SHAttered Lucky13 LogJam Factoring Protocols BREACH DROWN Mis-issuance 3HS
20 Best Practices Encryption BEAST FREAK CRIME POODLE Cryptographic hashes Sweet32 SLOTH NOMORE FLAME Public keys SHAttered Lucky13 LogJam Factoring Protocols Revocation BREACH DROWN Mis-issuance 3HS
21 Best Practices Encryption BEAST FREAK CRIME POODLE Cryptographic hashes Sweet32 SLOTH NOMORE FLAME Public keys SHAttered Lucky13 LogJam Factoring Protocols Revocation BREACH DROWN Mis-issuance 3HS
22 Encryption
23 Encryption RC4 3DES-CBC AES-CBC
24 Encryption RC4 3DES-CBC AES-CBC Future removal: RC4 and 3DES
25 Encryption RC4 3DES-CBC AES-GCM ChaCha20/Poly1305 AES-CBC Future removal: RC4 and 3DES
26 Cryptographic Hashes
27 Cryptographic Hashes MD5 SHA-1
28 Cryptographic Hashes MD5 SHA-1 New removal: SHA-1 signed certificates for TLS
29 Cryptographic Hashes MD5 SHA-2 Family SHA-1 New removal: SHA-1 signed certificates for TLS
30 Public Keys
31 Public Keys <1024-bit RSA
32 Public Keys <2048-bit RSA
33 Public Keys <2048-bit RSA New removal: <2048-bit RSA for TLS
34 Public Keys <2048-bit RSA 2048-bit RSA Elliptic Curves New removal: <2048-bit RSA for TLS
35 Protocols
36 Protocols SSLv3 TLS 1.0 TLS 1.1
37 Protocols SSLv3 TLS 1.2 TLS 1.0 TLS 1.1
38 Protocols SSLv3 TLS 1.2 TLS 1.0 TLS 1.1 New addition: TLS 1.3 (draft)
39 Revocation
40 Revocation No checking
41 Revocation No checking OCSP Stapling
42 Revocation Online Certificate Status Protocol Certificate Authority Server Client
43 Revocation Online Certificate Status Protocol Certificate Authority Server Client
44 Revocation Online Certificate Status Protocol Certificate Authority Server Client
45 Revocation Online Certificate Status Protocol Certificate Authority? Server Client
46 Revocation Online Certificate Status Protocol Certificate Authority? Server Client
47 Revocation Online Certificate Status Protocol
48 Revocation Online Certificate Status Protocol Additional network connection
49 Revocation Online Certificate Status Protocol Additional network connection Compromises user privacy
50 Revocation Online Certificate Status Protocol Additional network connection Compromises user privacy Requires app opt-in
51 Revocation OCSP Stapling Certificate Authority Server Client
52 Revocation OCSP Stapling Certificate Authority Server Client
53 Revocation OCSP Stapling Certificate Authority? Server Client
54 Revocation OCSP Stapling Certificate Authority? Server Client
55 Revocation OCSP Stapling Certificate Authority? Server Client
56 Revocation OCSP Stapling
57 Revocation OCSP Stapling Slow adoption
58 Revocation OCSP Stapling Slow adoption Does not protect against malicious servers
59 Revocation Enhancement Apple
60 Revocation Enhancement CT Log Apple
61 Revocation Enhancement Certificate Authority CT Log Certificate Authority Apple Certificate Authority
62 Revocation Enhancement Certificate Authority CT Log? Certificate Authority? Apple? Certificate Authority
63 Revocation Enhancement Certificate Authority CT Log Certificate Authority Apple Certificate Authority
64 Revocation Enhancement Certificate Authority CT Log Certificate Authority Apple Certificate Authority
65 Revocation Enhancement Certificate Authority CT Log Certificate Authority Apple Certificate Authority Client
66 Revocation Improvements
67 Revocation Improvements Reduced privacy compromise
68 Revocation Improvements Reduced privacy compromise Automatic updating
69 Revocation Improvements Reduced privacy compromise Automatic updating Faster connections
70 Evolving Standards
71 Evolving Standards Encryption RC4, CBC modes AES-GCM ChaCha20/Poly1305
72 Evolving Standards Encryption RC4, CBC modes AES-GCM ChaCha20/Poly1305 Hashes MD5, SHA-1 SHA-2 family
73 Evolving Standards Encryption RC4, CBC modes AES-GCM ChaCha20/Poly1305 Hashes MD5, SHA-1 SHA-2 family Public Keys <2048-bit RSA 2048-bit RSA Elliptic curves
74 Evolving Standards Encryption RC4, CBC modes AES-GCM ChaCha20/Poly1305 Hashes MD5, SHA-1 SHA-2 family Public Keys <2048-bit RSA 2048-bit RSA Elliptic curves Protocols SSLv3, TLS 1.0, TLS TLS 1.2+
75 Evolving Standards Encryption RC4, CBC modes AES-GCM ChaCha20/Poly1305 Hashes MD5, SHA-1 SHA-2 family Public Keys <2048-bit RSA 2048-bit RSA Elliptic curves Protocols SSLv3, TLS 1.0, TLS TLS 1.2+ Revocation No checking Certificate Transparency OCSP Stapling
76 TLS Trust Removals
77 Trust Removals
78 Trust Removals SHA-1 signed certificates for TLS
79 Trust Removals SHA-1 signed certificates for TLS Certificates using <2048-bit RSA for TLS
80 Trust Removals
81 Trust Removals Does not affect
82 Trust Removals Does not affect Root certificates
83 Trust Removals Does not affect Root certificates Enterprise-distributed certificates
84 Trust Removals Does not affect Root certificates Enterprise-distributed certificates User-installed certificates
85 Trust Removals Does not affect Root certificates Enterprise-distributed certificates User-installed certificates Client certificates
86 Trust Removals sha1-intermediate.badssl.com
87 Trust Removals sha1-intermediate.badssl.com
88 Trust Removals
89 Trust Removals InvalidCertChain (-9807) SSL errors with URLSession
90 Trust Removals InvalidCertChain (-9807) SSL errors with URLSession Servers to upgrade to new certificates
91 Trust Removals InvalidCertChain (-9807) SSL errors with URLSession Servers to upgrade to new certificates
92 What to Do Now?
93 What to Do Now? Check your implementations, libraries, and servers
94 What to Do Now? Check your implementations, libraries, and servers Server Developers
95 What to Do Now? Check your implementations, libraries, and servers Server Developers Replace any SHA-1 certificates or weak RSA keys
96 What to Do Now? Check your implementations, libraries, and servers Server Developers Replace any SHA-1 certificates or weak RSA keys Upgrade servers to TLS 1.2 and authenticated encryption ciphers
97 What to Do Now? Check your implementations, libraries, and servers Server Developers Replace any SHA-1 certificates or weak RSA keys Upgrade servers to TLS 1.2 and authenticated encryption ciphers Use OCSP Stapling
98 What to Do Now? Check your implementations, libraries, and servers Server Developers Replace any SHA-1 certificates or weak RSA keys Upgrade servers to TLS 1.2 and authenticated encryption ciphers Use OCSP Stapling Check that your certificates are in CT logs
99 What to Do Now? Check your implementations, libraries, and servers Server Developers Replace any SHA-1 certificates or weak RSA keys Upgrade servers to TLS 1.2 and authenticated encryption ciphers Use OCSP Stapling Check that your certificates are in CT logs App Developers
100 What to Do Now? Check your implementations, libraries, and servers Server Developers Replace any SHA-1 certificates or weak RSA keys Upgrade servers to TLS 1.2 and authenticated encryption ciphers Use OCSP Stapling Check that your certificates are in CT logs App Developers Avoid ATS exceptions
101 App Transport Security Update Chris Wood, Secure Transports Engineer
102 App Transport Security Current standards
103 App Transport Security Current standards From HTTP to HTTPS TLS 1.2 Strong cryptography AES and SHA-2 Forward Secrecy ECDHE
104 App Transport Security Current standards From HTTP to HTTPS TLS 1.2 Strong cryptography AES and SHA-2 Forward Secrecy ECDHE Exceptions per-domain, narrow
105 Exception Updates
106 Exception Updates Expansion beyond WebKit AVFoundation loads WebView requests Local network connections
107 Exception Updates Expansion beyond WebKit AVFoundation loads WebView requests Local network connections Certificate Transparency requirement
108 ATS-Compliant Services Practice what you preach APNs iwork FaceTime Spotlight Game Center iad Apple Services itunes icloud Services (Mail, CloudKit) Software Update
109 ATS on the Rise
110 ATS on the Rise ATS adoption is increasing
111 ATS on the Rise ATS adoption is increasing Still more work to be done
112 ATS on the Rise ATS adoption is increasing Still more work to be done Minimize or reduce exceptions
113 Transport Layer Security
114 SSL and TLS Lineage A long road
115 SSL and TLS Lineage A long road TLS
116 SSL and TLS Lineage A long road TLS 1.0 TLS
117 SSL and TLS Lineage A long road TLS 1.0 TLS 1.1 TLS
118 SSL and TLS Lineage A long road TLS 1.0 TLS 1.1 TLS 1.2 TLS 1.3 (draft)
119 TLS 1.3 Best practice by design
120 TLS 1.3 Best practice by design Strong cryptography and Forward Secrecy by default Legacy options, ciphers, and key exchange algorithms removed
121 TLS 1.3 Best practice by design Strong cryptography and Forward Secrecy by default Legacy options, ciphers, and key exchange algorithms removed Overall simpler specification
122 TLS 1.3 Best practice by design Strong cryptography and Forward Secrecy by default Legacy options, ciphers, and key exchange algorithms removed Overall simpler specification Improved network efficiency
123 TLS 1.3 Overview Improved efficiency TLS 1.2 TLS 1.3 Client Server Client Server Time
124 TLS 1.3 Overview Improved efficiency TLS 1.2 TLS 1.3 Client Server Client Server SYN SYN SYN+ACK SYN+ACK ACK ACK Time
125 TLS 1.3 Overview Improved efficiency TLS 1.2 TLS 1.3 Client Server Client Server SYN SYN SYN+ACK SYN+ACK ACK ACK CH SH Time CH, KEX SH, KEX CH - Client Hello SH - Server Hello KEX - Key Share
126 TLS 1.3 Overview Improved efficiency TLS 1.2 TLS 1.3 Client Server Client Server SYN SYN SYN+ACK SYN+ACK ACK ACK CH SH KEX Time CH, KEX SH, KEX DATA CH - Client Hello SH - Server Hello KEX - Key Share KEX
127 TLS 1.3 Overview Improved efficiency TLS 1.2 TLS 1.3 Client Server Client Server SYN SYN SYN+ACK SYN+ACK ACK ACK CH SH KEX Time CH, KEX SH, KEX DATA CH - Client Hello SH - Server Hello KEX - Key Share KEX DATA
128 How to Enable TLS 1.3 Beta?
129 How to Enable TLS 1.3 Beta? It is not on by default
130 How to Enable TLS 1.3 Beta? It is not on by default You can install a profile on ios
131 How to Enable TLS 1.3 Beta? It is not on by default You can install a profile on ios You can enable system-wide TLS 1.3 on macos defaults write /Library/Preferences/com.apple.networkd tcp_connect_enable_tls13 1
132 TLS 1.3 Outlook
133 TLS 1.3 Outlook IETF standardization ( )
134 TLS 1.3 Outlook IETF standardization ( ) Third-party collaboration
135 TLS 1.3 Outlook IETF standardization ( ) Third-party collaboration Enterprise preparation
136 Takeaways
137 Takeaways Implement best practices
138 Takeaways Implement best practices Avoid new and future algorithm removals
139 Takeaways Implement best practices Avoid new and future algorithm removals Continue upgrading to modern TLS configurations
140 Takeaways Implement best practices Avoid new and future algorithm removals Continue upgrading to modern TLS configurations Minimize or remove App Transport Security exceptions
141 Takeaways Implement best practices Avoid new and future algorithm removals Continue upgrading to modern TLS configurations Minimize or remove App Transport Security exceptions Try out TLS 1.3
142 More Information
143 Related Sessions Privacy and Your Apps Executive Ballroom Tuesday 11:20AM Advances in Networking, Part 1 Executive Ballroom Wednesday 3:10PM Advances in Networking, Part 2 Executive Ballroom Wednesday 4:10PM
144 Labs Security & Privacy Technology Lab D Tue 1:50PM-3:50PM Security & Privacy Technology Lab J Wed 1:00PM-3:30PM Networking Lab Technology Lab D Thu 9:00AM-11:00AM Networking Lab Technology Lab J Fri 1:50PM-3:50PM
145
TLS1.2 IS DEAD BE READY FOR TLS1.3
TLS1.2 IS DEAD BE READY FOR TLS1.3 28 March 2017 Enterprise Architecture Technology & Operations Presenter Photo Motaz Alturayef Jubial Cyber Security Conference 70% Privacy and security concerns are
Overview of TLS v1.3 What s new, what s removed and what s changed?
Overview of TLS v1.3 What s new, what s removed and what s changed? About Me Andy Brodie Solution Architect / Principal Design Engineer. On Worldpay ecommerce Payment Gateways. Based in Cambridge, UK.
Overview of TLS v1.3. What s new, what s removed and what s changed?
Overview of TLS v1.3 What s new, what s removed and what s changed? About Me Andy Brodie Worldpay Principal Design Engineer. Based in Cambridge, UK. andy.brodie@owasp.org Neither a cryptographer nor a
Verifying Real-World Security Protocols from finding attacks to proving security theorems
Verifying Real-World Security Protocols from finding attacks to proving security theorems Karthik Bhargavan http://prosecco.inria.fr + many co-authors at INRIA, Microsoft Research, Formal security analysis
TLS 1.1 Security fixes and TLS extensions RFC4346
F5 Networks, Inc 2 SSL1 and SSL2 Created by Netscape and contained significant flaws SSL3 Created by Netscape to address SSL2 flaws TLS 1.0 Standardized SSL3 with almost no changes RFC2246 TLS 1.1 Security
SSL Report: ( )
Home Projects Qualys.com Contact You are here: Home > Projects > SSL Server Test > www.workbench.nationaldataservice.org SSL Report: www.workbench.nationaldataservice.org (141.142.210.100) Assessed on:
Securing Connections for IBM Traveler Apps. Bill Wimer STSM for IBM Collaboration Solutions December 13, 2016
Securing Connections for IBM Traveler Apps Bill Wimer (bwimer@us.ibm.com), STSM for IBM Collaboration Solutions December 13, 2016 IBM Technote Article #21989980 Securing Connections for IBM Traveler mobile
SSL Report: printware.co.uk ( )
1 of 5 26/06/2015 14:27 Home Projects Qualys.com Contact You are here: Home > Projects > SSL Server Test > printware.co.uk SSL Report: printware.co.uk (194.143.166.5) Assessed on: Fri, 26 Jun 2015 12:53:08
HTTPS is Fast and Hassle-free with Cloudflare
HTTPS is Fast and Hassle-free with Cloudflare 1 888 99 FLARE enterprise@cloudflare.com www.cloudflare.com In the past, organizations had to choose between performance and security when encrypting their
SSL / TLS. Crypto in the Ugly Real World. Malvin Gattinger
SSL / TLS Crypto in the Ugly Real World Malvin Gattinger 2016-03-17 SSL/TLS Figure 1: The General Picture SSL or TLS Goal: Authentication and Encryption Secure Sockets Layer SSL 1 (never released), 2 (1995-2011)
The State of TLS in httpd 2.4. William A. Rowe Jr.
The State of TLS in httpd 2.4 William A. Rowe Jr. wrowe@apache.org Getting Started Web references have grown stale Web references have grown stale Guidance is changing annually https://www.ssllabs.com/ssltest/analyze.ht
SSL Report: cartridgeworld.co.uk ( )
1 of 5 26/06/2015 14:21 Home Projects Qualys.com Contact You are here: Home > Projects > SSL Server Test > cartridgeworld.co.uk SSL Report: cartridgeworld.co.uk (95.138.147.104) Assessed on: Fri, 26 Jun
Overview of SSL/TLS. Luke Anderson. 12 th May University Of Sydney.
Overview of SSL/TLS Luke Anderson luke@lukeanderson.com.au 12 th May 2017 University Of Sydney Overview 1. Introduction 1.1 Raw HTTP 1.2 Introducing SSL/TLS 2. Certificates 3. Attacks Introduction Raw
SSL Report: bourdiol.xyz ( )
Home Projects Qualys.com Contact You are here: Home > Projects > SSL Server Test > bourdiol.xyz > 217.70.180.152 SSL Report: bourdiol.xyz (217.70.180.152) Assessed on: Sun Apr 19 12:22:55 PDT 2015 HIDDEN
SSL Report: sharplesgroup.com ( )
1 of 5 26/06/2015 14:28 Home Projects Qualys.com Contact You are here: Home > Projects > SSL Server Test > sharplesgroup.com SSL Report: sharplesgroup.com (176.58.116.26) Assessed on: Fri, 26 Jun 2015
Computer Security. 10r. Recitation assignment & concept review. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 10r. Recitation assignment & concept review Paul Krzyzanowski Rutgers University Spring 2018 April 3, 2018 CS 419 2018 Paul Krzyzanowski 1 1. What is a necessary condition for perfect
SSL/TLS Security Assessment of e-vo.ru
SSL/TLS Security Assessment of e-vo.ru Test SSL/TLS implementation of any service on any port for compliance with industry best-practices, NIST guidelines and PCI DSS requirements. The server configuration
SSL/TLS Server Test of
SSL/TLS Server Test of www.rotenburger-gruene.de Test SSL/TLS implementation of any service on any port for compliance with PCI DSS requirements, HIPAA guidance and NIST guidelines. WWW.ROTENBURGER-GRUENE.DE
Defeating All Man-in-the-Middle Attacks
Defeating All Man-in-the-Middle Attacks PrecisionAccess Vidder, Inc. Defeating All Man-in-the-Middle Attacks 1 Executive Summary The man-in-the-middle attack is a widely used and highly preferred type
Coming of Age: A Longitudinal Study of TLS Deployment
Coming of Age: A Longitudinal Study of TLS Deployment Accepted at ACM Internet Measurement Conference (IMC) 2018, Boston, MA, USA Platon Kotzias, Abbas Razaghpanah, Johanna Amann, Kenneth G. Paterson,
What s New in Device Configuration, Deployment, and Management
Session Distribution #WWDC17 What s New in Device Configuration, Deployment, and Management 304 Todd Fernandez, Senior Manager, Device Management and Server 2017 Apple Inc. All rights reserved. Redistribution
WAP Security. Helsinki University of Technology S Security of Communication Protocols
WAP Security Helsinki University of Technology S-38.153 Security of Communication Protocols Mikko.Kerava@iki.fi 15.4.2003 Contents 1. Introduction to WAP 2. Wireless Transport Layer Security 3. Other WAP
Findings for
Findings for 198.51.100.23 Scan started: 2017-07-11 12:30 UTC Scan ended: 2017-07-11 12:39 UTC Overview Medium: Port 443/tcp - NEW Medium: Port 443/tcp - NEW Medium: Port 443/tcp - NEW Medium: Port 80/tcp
SSL/TLS: Still Alive? Pascal Junod // HEIG-VD
SSL/TLS: Still Alive? Pascal Junod // HEIG-VD 26-03-2015 Agenda SSL/TLS Protocol Attacks What s next? SSL/TLS Protocol SSL/TLS Protocol Family of cryptographic protocols offering following functionalities:
SECRETS OF THE ENCRYPTED INTERNET: WORLDWIDE CRYPTOGRAPHIC TRENDS
SESSION ID: PDAC-F02 SECRETS OF THE ENCRYPTED INTERNET: WORLDWIDE CRYPTOGRAPHIC TRENDS David Holmes Threat Researcher F5 Networks, Inc. @dholmesf5 Who is that Guy? David Holmes Childhood crypto enthusiast
Designing Network Encryption for the Future Emily McAdams Security Engagement Manager, Security & Trust Organization BRKSEC-2015
Designing Network Encryption for the Future Emily McAdams Security Engagement Manager, Security & Trust Organization BRKSEC-2015 What Could It Cost You? Average of $0.58 a record According to the Verizon
How to Configure SSL Interception in the Firewall
Most applications encrypt outgoing connections with SSL or TLS. SSL Interception decrypts SSL-encrypted HTTPS and SMTPS traffic to allow Application Control features (such as the Virus Scanner, ATP, URL
Version: $Revision: 1142 $
Check for SSL Weak Ciphers Application: https Port: 443 ScriptID: 103440 Weak ciphers offered by this service: SSL2_RC4_128_MD5 SSL2_RC4_128_EXPORT40_WITH_MD5 SSL2_RC2_CBC_128_CBC_WITH_MD5 SSL2_RC2_CBC_128_CBC_EXPORT40_WITH_MD5
SSL/TLS & 3D Secure. CS 470 Introduction to Applied Cryptography. Ali Aydın Selçuk. CS470, A.A.Selçuk SSL/TLS & 3DSec 1
SSL/TLS & 3D Secure CS 470 Introduction to Applied Cryptography Ali Aydın Selçuk CS470, A.A.Selçuk SSL/TLS & 3DSec 1 SSLv2 Brief History of SSL/TLS Released in 1995 with Netscape 1.1 Key generation algorithm
TLS/sRTP Voice Recording AddPac Technology
Secure IP Telephony Solution (TLS/SRTP Protocol) TLS/sRTP Voice Recording AddPac Technology 2015, Sales and Marketing www.addpac.com Contents Secure IP Telephony Service Diagram Secure VoIP Protocol &
Transport Level Security
2 Transport Level Security : Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l12, Steve/Courses/2013/s2/css322/lectures/transport.tex,
Your Apps and the Future of macos Security
#WWDC18 Your Apps and the Future of macos Security Pierre-Olivier Martel, Security Engineering Manager Kelly Yancey, OS Security Garrett Jacobson, Trusted Execution 2018 Apple Inc. All rights reserved.
32c3. December 28, Nick https://crypto.dance. goto fail;
32c3 December 28, 2015 Nick Sullivan @grittygrease nick@cloudflare.com https://crypto.dance goto fail; a compendium of transport security calamities Broken Key 2 Lock 3 Lock 4 5 6 HTTP HTTPS The S stands
CIS 5373 Systems Security
CIS 5373 Systems Security Topic 4.3: Network Security SSL/TLS Endadul Hoque Slide Acknowledgment Contents are based on slides from Cristina Nita-Rotaru (Northeastern) Analysis of the HTTPS Certificate
Protecting TLS from Legacy Crypto
Protecting TLS from Legacy Crypto http://mitls.org Karthikeyan Bhargavan + many, many others. (INRIA, Microsoft Research, LORIA, IMDEA, Univ of Pennsylvania, Univ of Michigan, JHU) Popular cryptographic
State of TLS usage current and future. Dave Thompson
State of TLS usage current and future Dave Thompson TLS Client/Server surveys Balancing backward compatibility with security. As new vulnerabilities are discovered, when can we shutdown less secure TLS
Understand the TLS handshake Understand client/server authentication in TLS. Understand session resumption Understand the limitations of TLS
Last Updated: Oct 31, 2017 Understand the TLS handshake Understand client/server authentication in TLS RSA key exchange DHE key exchange Explain certificate ownership proofs in detail What cryptographic
BIG-IP System: SSL Administration. Version
BIG-IP System: SSL Administration Version 13.0.0 Table of Contents Table of Contents About SSL Administration on the BIG-IP System...7 About SSL administration on the BIG-IP system... 7 Device Certificate
About FIPS, NGE, and AnyConnect
About FIPS, NGE, and AnyConnect, on page 1 Configure FIPS for the AnyConnect Core VPN Client, on page 4 Configure FIPS for the Network Access Manager, on page 5 About FIPS, NGE, and AnyConnect AnyConnect
SECURE YOUR INTEGRATIONS. Maarten Smeets
SECURE YOUR INTEGRATIONS Maarten Smeets 07-06-2018 About Maarten Integration consultant at AMIS since 2014 Several certifications SOA, BPM, MCS, Java, SQL, PL/SQL, Mule, AWS, etc Enthusiastic blogger http://javaoraclesoa.blogspot.com
Chapter 4: Securing TCP connections
Managing and Securing Computer Networks Guy Leduc Chapter 5: Securing TCP connections Computer Networking: A Top Down Approach, 6 th edition. Jim Kurose, Keith Ross Addison-Wesley, March 2012. (section
IBM Education Assistance for z/os V2R1
IBM Education Assistance for z/os V2R1 Items: TLS V1.2 Suite B RFC 5280 Certificate Validation Element/Component: Cryptographic Services - System SSL Material is current as of June 2013 Agenda Trademarks
SSL/TLS. Pehr Söderman Natsak08/DD2495
SSL/TLS Pehr Söderman Pehrs@kth.se Natsak08/DD2495 1 Historical problems No general purpose security wrapper Kerberos doesn't cut it! Each protocol has it's own security layer SNMP, Ktelnet Or none at
Cryptography SSL/TLS. Network Security Workshop. 3-5 October 2017 Port Moresby, Papua New Guinea
Cryptography SSL/TLS Network Security Workshop 3-5 October 2017 Port Moresby, Papua New Guinea 1 History Secure Sockets Layer was developed by Netscape in 1994 as a protocol which permitted persistent
Requirements from the. Functional Package for Transport Layer Security (TLS)
Requirements from the Functional Package for Transport Layer Security (TLS) Version: 1.0 2018-12-17 National Information Assurance Partnership Revision History Version Date Comment Introduction Purpose.
2015 Online Trust Audit & Honor Roll Methodology
2015 Online Trust Audit & Honor Roll Methodology Jeff Wilbur VP Marketing, Iconix Craig Spiezle Executive Director & President, OTA 2015 All rights reserved. Online Trust Alliance (OTA) Slide 1 Who Is
Transport Layer Security
CEN585 Computer and Network Security Transport Layer Security Dr. Mostafa Dahshan Department of Computer Engineering College of Computer and Information Sciences King Saud University mdahshan@ksu.edu.sa
Cipher Suite Configuration Mode Commands
The Cipher Suite Configuration Mode is used to configure the building blocks for SSL cipher suites, including the encryption algorithm, hash function, and key exchange. Important The commands or keywords/variables
Transport Layer Security
Transport Layer Security TRANSPORT LAYER SECURITY PERFORMANCE TESTING OVERVIEW Transport Layer Security (TLS) and its predecessor Secure Sockets Layer (SSL), are the most popular cryptographic protocols
Evolving Standards in Security. Michael Garrison Stuber
Evolving Standards in Security Michael Garrison Stuber Sad but true... Cartoon courtesy of xkcd.com Trends & Responses Evolution from unsecure to secure Acceptance of ECC Struggling with certificates Demand
Digital Certificates Demystified
Digital Certificates Demystified Ross Cooper, CISSP IBM Corporation RACF/PKI Development Poughkeepsie, NY Email: rdc@us.ibm.com August 9 th, 2012 Session 11622 Agenda Cryptography What are Digital Certificates
Cryptography MIS
Cryptography MIS-5903 http://community.mis.temple.edu/mis5903sec011s17/ Cryptography History Substitution Monoalphabetic Polyalphabetic (uses multiple alphabets) uses Vigenere Table Scytale cipher (message
Randomness Extractors. Secure Communication in Practice. Lecture 17
Randomness Extractors. Secure Communication in Practice Lecture 17 11:00-12:30 What is MPC? Manoj Monday 2:00-3:00 Zero Knowledge Muthu 3:30-5:00 Garbled Circuits Arpita Yuval Ishai Technion & UCLA 9:00-10:30
Secure Internet Communication
Secure Internet Communication Can we prevent the Cryptocalypse? Dr. Gregor Koenig Barracuda Networks AG 09.04.2014 Overview Transport Layer Security History Orientation Basic Functionality Key Exchange
Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 11 Basic Cryptography
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 11 Basic Cryptography Objectives Define cryptography Describe hashing List the basic symmetric cryptographic algorithms 2 Objectives
What s New in CloudKit
System Frameworks #WWDC15 What s New in CloudKit Session 704 Olivier Bonnet icloud Client Eric Krugler icloud Server 2015 Apple Inc. All rights reserved. Redistribution or public display not permitted
Secure Socket Layer Health Assessment
Secure Socket Layer Health Assessment Mick Pouw, Eric van den Haak February 5, 2014 1 Introduction Background Research Questions 2 Research Implementing SSL, the right way Common mistakes Classifying mistakes
General System Requirements mymcs Apps
General System Requirements mymcs Apps Document status Document owner LIVE Thomas Verdyck Goals Get insight on the minimal hardware & software requirements needed for running an app of the mymcs Software
Let s Encrypt and DANE
Let s Encrypt and DANE CaribNOG 13 Barbados 18 Apr 2017 The Deploy360 Programme The Challenge: The IETF creates protocols based on open standards, but some are not widely known or deployed People seeking
ArrayOS AG Release Note
Introduction Release Date: September 30, 2018 This release note summarizes the general enhancements, resolved issues and known limitations for ArrayOS AG 9.4.0.233 release. Contacting Customer Support
SSL/TLS Server Test of grupoconsultorefe.com
SSL/TLS Server Test of grupoconsultorefe.com Test SSL/TLS implementation of any service on any port for compliance with PCI DSS requirements, HIPAA guidance and NIST guidelines. GRUPOCONSULTOREFE.COM FINAL
DROWN - Breaking TLS using SSLv2
DROWN - Breaking TLS using SSLv2 Nimrod Aviram, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta, David Adrian, J. Alex Halderman, Viktor Dukhovni, Emilia Käsper,
APNIC elearning: Cryptography Basics
APNIC elearning: Cryptography Basics 27 MAY 2015 03:00 PM AEST Brisbane (UTC+10) Issue Date: Revision: Introduction Presenter Sheryl Hermoso Training Officer sheryl@apnic.net Specialties: Network Security
Extended Package for Secure Shell (SSH) Version: National Information Assurance Partnership
Extended Package for Secure Shell (SSH) Version: 1.1 2016-11-25 National Information Assurance Partnership Revision History Version Date Comment 0.9 2015-08-19 First Draft - Extended Package for Secure
SSL Accelerated Services. Feature Description
Feature Description UPDATED: 28 March 2018 Copyright Notices Copyright 2002-2018 KEMP Technologies, Inc. All rights reserved. KEMP Technologies and the KEMP Technologies logo are registered trademarks
securing a host Matsuzaki maz Yoshinobu
securing a host Matsuzaki maz Yoshinobu Hardening a host Differs per operating system Windows: users can not be trusted to make security related decisions in almost all cases OS X : make
TLS Security and Future
TLS Security and Future Martin Stanek Department of Computer Science Comenius University stanek@dcs.fmph.uniba.sk Cryptology 1 (2017/18) Content Fixing issues in practice Trust, Checking certificates and
BIG-IP System: SSL Administration. Version
BIG-IP System: SSL Administration Version 13.1.0 Table of Contents Table of Contents About SSL Administration on the BIG-IP System...7 About SSL administration on the BIG-IP system... 7 Device Certificate
Encrypted Phone Configuration File Setup
This chapter provides information about encrypted phone configuration files setup. After you configure security-related settings, the phone configuration file contains sensitive information, such as digest
Acronyms. International Organization for Standardization International Telecommunication Union ITU Telecommunication Standardization Sector
Acronyms 3DES AES AH ANSI CBC CESG CFB CMAC CRT DoS DEA DES DoS DSA DSS ECB ECC ECDSA ESP FIPS IAB IETF IP IPsec ISO ITU ITU-T Triple DES Advanced Encryption Standard Authentication Header American National
Overview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet. SSL ensures the secure transmission of data between a client and a server through
FIPS Management. FIPS Management Overview. Configuration Changes in FIPS Mode
This chapter contains the following sections: Overview, on page 1 Configuration Changes in FIPS Mode, on page 1 Switching the Appliance to FIPS Mode, on page 2 Encrypting Sensitive Data in FIPS Mode, on
What s New in watchos
Session App Frameworks #WWDC17 What s New in watchos 205 Ian Parks, watchos Engineering 2017 Apple Inc. All rights reserved. Redistribution or public display not permitted without written permission from
A Cryptographic Analysis of the TLS 1.3 Handshake Protocol Candidates. Felix Günther. Technische Universität Darmstadt, Germany
A Cryptographic Analysis of the TLS 1.3 Handshake Protocol Candidates Felix Günther Technische Universität Darmstadt, Germany joint work with Benjamin Dowling, Marc Fischlin, and Douglas Stebila April
SSL GOOD PRACTICE GUIDE
SSL GOOD PRACTICE GUIDE VERSION: 1.0 DATE: 20/09/2013 TASK NUMBER: SSL_Whitepaper PREPARED FOR Paul Docherty Director Portcullis Computer Security Ltd The Grange Barn Pike s End Pinner Middlesex HA5 2EX
SharkFest 17 Europe. SSL/TLS Decryption. uncovering secrets. Wednesday November 8th, Peter Wu Wireshark Core Developer
SharkFest 17 Europe SSL/TLS Decryption uncovering secrets Wednesday November 8th, 2017 Peter Wu Wireshark Core Developer peter@lekensteyn.nl 1 About me Wireshark contributor since 2013, core developer
Internet Engineering Task Force (IETF) ISSN: January Suite B Profile for Transport Layer Security (TLS)
Internet Engineering Task Force (IETF) M. Salter Request for Comments: 6460 National Security Agency Obsoletes: 5430 R. Housley Category: Informational Vigil Security ISSN: 2070-1721 January 2012 Abstract
SSL Visibility and Troubleshooting
Page 1 of 6 view online Avi Vantage provides a number of features to help understand the utilization of SSL traffic and troubleshoot SSL-related issues. Visibility Every virtual service provides a number
Validating HTTP Live Streams
Media #WWDC16 Validating HTTP Live Streams Session 510 Eryk Vershen Media Engineer 2016 Apple Inc. All rights reserved. Redistribution or public display not permitted without written permission from Apple.
Content Protection for HTTP Live Streaming
Media #WWDC15 Content Protection for HTTP Live Streaming Session 502 Roger Pantos HTTP Live Streaming Engineer 2015 Apple Inc. All rights reserved. Redistribution or public display not permitted without
A Cryptographic Analysis of the TLS 1.3 draft-10 Full and Pre-shared Key Handshake Protocol. Felix Günther. Technische Universität Darmstadt, Germany
A Cryptographic Analysis of the TLS 1.3 draft-10 Full and Pre-shared Key Handshake Protocol Felix Günther Technische Universität Darmstadt, Germany joint work with Benjamin Dowling, Marc Fischlin, and
FIPS Non-Proprietary Security Policy. Level 1 Validation Version 1.2
Oracle Solaris Kernel Cryptographic Framework with SPARC T4 and T5 Software Version: 1.0 and 1.1; Hardware Version: SPARC T4 (527-1437-01) and T5 (7043165) FIPS 140-2 Non-Proprietary Security Policy Level
Datapath. Encryption
Datapath The following refers to the IKE/IPsec datapath implementation of overlay tunnels between Silver Peak devices. VXOA Release 7.3 (Regular "IPsec" mode with IKE) 8.0 (Regular "IPsec" mode with IKE)
Release Notes. NCP Secure Enterprise Mac Client. 1. New Features and Enhancements. 2. Improvements / Problems Resolved. 3.
NCP Secure Enterprise Mac Client Service Release 2.05 Rev. 32317 Date: January 2017 Prerequisites Apple OS X Operating System: The following Apple OS X operating system versions are supported with this
NCP Secure Enterprise macos Client Release Notes
Service Release: 3.10 r40218 Date: July 2018 Prerequisites Apple OS X operating systems: The following Apple macos operating systems are supported with this release: macos High Sierra 10.13 macos Sierra
SMPTE Standards Transition Issues for NIST/FIPS Requirements
SMPTE Standards Transition Issues for NIST/FIPS Requirements Contents 2010.5.20 DRM inside Taehyun Kim 1 Introduction NIST (National Institute of Standards and Technology) published a draft special document
QUANTUM SAFE PKI TRANSITIONS
QUANTUM SAFE PKI TRANSITIONS Quantum Valley Investments Headquarters We offer quantum readiness assessments to help you identify your organization s quantum risks, develop an upgrade path, and deliver
Internet Engineering Task Force (IETF) Request for Comments: 7192 Category: Standards Track April 2014 ISSN:
Internet Engineering Task Force (IETF) S. Turner Request for Comments: 7192 IECA Category: Standards Track April 2014 ISSN: 2070-1721 Abstract Algorithms for Cryptographic Message Syntax (CMS) Key Package
Securing IoT applications with Mbed TLS Hannes Tschofenig Arm Limited
Securing IoT applications with Mbed TLS Hannes Tschofenig Agenda Theory Threats Security services Hands-on with Arm Keil MDK Pre-shared secret-based authentication (covered in webinar #1) TLS Protocol
Data Sheet. NCP Secure Entry Mac Client. Next Generation Network Access Technology
Universal VPN Client Suite for macos/os X Compatible with VPN Gateways (IPsec Standard) macos 10.13, 10.12, OS X 10.11, OS X 10.10 Import of third party configuration files Integrated, dynamic Personal
Datapath. Encryption
Datapath The following refers to the IKE/IPsec datapath implementation of overlay tunnels between Silver Peak devices. VXOA Release 7.3 (Regular "IPsec" mode with IKE) 8.0 (Regular "IPsec" mode with IKE)
History. TLS 1.3 Draft 26 Supported in TMOS v14.0.0
PRESENTED BY: History SSL developed by Netscape SSLv1.0 Never released SSLv2.0 1995 SSLv3.0 1996 Moved governance to the IETF and renamed TLS TLSv1.0 1999 TLSv1.1 2006 TLSv1.2 2008 TLSv1.3 2018 TLS 1.3
Release Notes. NCP Secure Enterprise Mac Client. 1. New Features and Enhancements. 2. Improvements / Problems Resolved. 3.
NCP Secure Enterprise Mac Client Service Release 2.05 Build 14711 Date: December 2013 Prerequisites Apple OS X Operating System: The following Apple OS X operating system versions are supported with this
Securely Deploying TLS 1.3. September 2017
Securely Deploying TLS 1.3 September 2017 Agenda Why TLS 1.3? Zero Round Trip Time (0-RTT) requests Forward secrecy Resumption key management Why TLS 1.3? Speed TLS impacts latency, not thoroughput Protocol
Norbert Muehr (Siemens PLM GTAC EMEA)
Presentation date: 2018 10 31 Presenter name: Room name: Presentation title: Norbert Muehr (Siemens PLM GTAC EMEA) Room Paris Hardening SSL Configuring a Teamcenter-System for Perfect Forward Secrecy PLM
IKEv2-SCSI (06-449) Update
1 IKEv2-SCSI (06-449) Update David L. Black 2 IKEv2-SCSI (06-449) Plans and Status Plan Revise IKEv2-SCSI draft for approval at this meeting Reality The best laid schemes o' Mice an' Men... gang aft FCoE!!
Internet security and privacy
Internet security and privacy SSL/TLS 1 Application layer App. TCP/UDP IP L2 L1 2 Application layer App. SSL/TLS TCP/UDP IP L2 L1 3 History of SSL/TLS Originally, SSL Secure Socket Layer, was developed
Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP,
Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls 32.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 32.2 Figure 32.1 Common structure
This version of the des Secure Enterprise MAC Client can be used on Mac OS X 10.7 Lion platform.
NCP Secure Enterprise MAC Client Service Release 2.02 Build 11 Date: August 2011 1. New Feature Compatibility to Mac OS X 10.7 Lion This version of the des Secure Enterprise MAC Client can be used on Mac
Authenticated Encryption in TLS
Authenticated Encryption in TLS Same modelling & verification approach concrete security: each lossy step documented by a game and a reduction (or an assumption) on paper Standardized complications - multiple