Felix Günther. Technische Universität Darmstadt, Germany. joint work with Benjamin Dowling, Marc Fischlin, and Douglas Stebila
|
|
|
- Rudolf Lang
- 5 years ago
- Views:
Transcription
1 A Cryptographic Analysis of the TLS 1.3 Handshake Protocol Candidates The main modes, 0-RTT, and replays Felix Günther Technische Universität Darmstadt, Germany joint work with Benjamin Dowling, Marc Fischlin, and Douglas Stebila July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 1
2 Key Exchange pk B, sk A K KE pk A, sk B We SKECH! K July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 2 drawings by Giorgia Azzurra Marson
![TLS History The [TLS] protocol allows client/server applications to communicate in a way that is designed to prevent](/docs-images/93/111285746/images/3-0.jpg "eavesdropping, tampering, or message forgery. TLS 1.2 [RFC 5246] 1995 SSL 2.0 1996 SSL 3.0 1999 TLS 1.0 2006 TLS 1.")
3 TLS History The [TLS] protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery. TLS 1.2 [RFC 5246] 1995 SSL SSL TLS TLS % of global Internet traffic expected to be encrypted in 2016 (Sandvine: Internet Traffic Encryption Trends, Feb 2016) 2008 TLS x TLS 1.3 July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 3
4 TLS 1.3 next TLS version, currently being specified (latest: draft-13, May 2016) several substantial cryptographic changes (compared to TLS 1.2), incl. 1. encrypting some handshake messages with intermediate session key 2. signing the entire transcript when authenticating 3. including handshake message hashes in key calculations 4. generating Finished messages with separate key 5. deprecating some crypto algorithms (RC4, SHA-1, key transport, MtEE, etc.) 6. using only AEAD schemes for the record layer encryption 7. switch to HKDF for key derivation 8. providing reduced-latency 0-RTT handshake July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 4
5 TLS Overview Handshake Protocol (EC)DHE PSK 0-RTT Alert Protocol App. Data Protocol Record Protocol Record Protocol we analyze the handshake protocol candidates for TLS 1.3 July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 5 STANDARD UNDER CONSTRUCTION
6 TLS 1.3 Full/(EC)DHE Handshake (simplified) Client ClientHello ClientKeyShare ClientCertificate ClientCertificateVerify ClientFinished Server ServerHello ServerKeyShare CertificateRequest ServerCertificate ServerCertificateVerify ServerFinished application data traffic key tk app tk app... actually, there is more... July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 6
7 TLS 1.3 Full/(EC)DHE and PSK Handshake (simplified) Client ClientHello ClientPreSharedKey PSK variant ClientCertificate ClientCertificateVerify ClientFinished Server ServerHello ServerPreSharedKey CertificateRequest ServerCertificate ServerCertificateVerify ServerFinished tk app tk app July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 6
8 TLS 1.3 Full/(EC)DHE and PSK Handshake (still simplified) multi-stage key exchange tk hs Client ClientHello ClientKeyShare handshake traffic key resumption master key for resuming a session {ClientCertificate } {ClientCertificateVerify } {ClientFinished} Server second part of handshake encrypted with tk hs ServerHello ServerKeyShare {CertificateRequest } {ServerCertificate } {ServerCertificateVerify } {ServerFinished} tk hs exporter master key for exporting key material tk app RMS EMS July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 6 tk app RMS EMS
9 Multi-Stage Key Exchange (Security) SKECH 2014 (Fischlin, CCS 2014) forward secrecy after long-term reveal corruption pk B, sk A eavesdropping key K i reveal active attacks pk A, sk B KE??? K 1 K 1 $ test K i key independence in derivation K 2 K 2... July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 7 drawings by Giorgia Azzurra Marson
10 Security of the draft-10 (EC)DHE Handshake Client ClientHello: r c $ {0, 1} 256 ClientKeyShare: X g x Server ServerHello: r s $ {0, 1} 256 ServerKeyShare: Y g y H 1 H(CH... SKS) ES X y {ServerCertificate } H 2 H(CH... SCRT... ) {SCertVerify }: Sign sks (H 2 ) {ServerFinished} {CCert },{CCertVerify },{CFin} H sess H(CH... CCV ) session hash signing tk hs tk app RMS,EMS tk hs tk app EMS 0 ES Ext xes July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 8 H1 Exp Hsess Exp Exp mes Ext MS (still simplified) SS sound key separation 0 Ext Hsess Exp Hsess Exp xss Exp mss RMS (resumption)
11 Security of the draft-10 (EC)DHE Handshake We show that the draft-10 full (EC)DHE handshake establishes random-looking keys (tk hs, tk app, RMS, EMS) with adversary allowed to corrupt other users and reveal other session keys forward secrecy for all these keys concurrent security of anonymous, unilateral, mutual authentication key independence (leakage of traffic/resumption/exporter keys in same session does not compromise each other s security) assuming collision-resistant hashing unforgeable signatures HKDF is pseudorandom function PRF-ODH assumption holds standard key exchange security under standard(-model) assumptions July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 9
12 Security of the draft-10 PSK Handshakes PSK random-looking keys (tk hs, tk app, EMS) mutual authentication (down to RMS) key independence no forward secrecy PSK-DHE random-looking keys (tk hs, tk app, EMS) mutual authentication (down to RMS) key independence forward secrecy for all keys Under similar standard(-model) assumptions: collision-resistant hashing HKDF is pseudorandom function collision-resistant hashing HKDF is pseudorandom function HMAC is unforgeable PRF-ODH assumption holds July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 10
13 Zero Round-Trip Time (0-RTT) 1 RTT KE K CH K July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 11
14 Zero Round-Trip Time (0-RTT) K 0 KE 0-RTT CH K 0 K CH K July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 11
15 Diffie Hellman-based 0-RTT à la QUIC, but also TLS 1.3 DH-based 0-RTT mode semi-static server pk = g s earlier full handshake semi-static server sk = s g x K 0 = g xs 0-RTT data K 0 = g xs K 1 = g xy g y K 1 = g xy July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 12
16 Diffie Hellman-based 0-RTT à la QUIC, but also TLS 1.3 DH-based 0-RTT mode semi-static server pk = g s earlier full handshake n, g x n, g x semi-static server sk = s K 0 = g xs 0-RTT data K 0 = g xs 0-RTT data Duplicate n! what about replays? QUIC: remember nonces in strike register (restricted by orbit +time) effectively prevents same key is derived twice July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 12
17 Generic Replay Attack on 0-RTT (by Daniel Kahn Gillmore) 0-RTT KE msg (n, g x ) 0-RTT data "/buy-something" simpler in real world: send to two distributed servers accept 0-RTT, KE response (g y ) enforce state loss (e.g., reboot) replay 0-RTT KE msg (n, g x ) replay "/buy-s.. reject 0-RTT, KE response msg (g y ) complete KE process "/buy-s.. rej. after state loss for security reasons (resend) "/buy-something" under final key process "/buy-s.. again July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 13
18 Generic Replay Attack on 0-RTT What s going on? attack applies to QUIC vs. security proofs for QUIC [FG 14, LJBN 15] standard answer: out of model actually sth. beyond KE: it s conscious replay on application level This isn t that odd, since, as AGL observes, browsers already routinely retry some HTTP requests that appear to fail even for ordinary TLS [...] but of course that s different from having TLS give up those guarantees. Eric TLS mailing list July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 14
19 QUIC s Response The QUIC crypto protocol is destined to die. Langley, Chang / QUIC Crypto, Revision we claim: actually provides some replay protection, just on a different level distinguish between KE level and application level (latter fundamentally beyond what KE can protect against) KE KE K KE K m m CH July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 15
20 TLS 1.3 s Response can t protect against replays anyway (on application level) so give up any replay protection for 0-RTT i.e. don t check for duplicate nonces, allow keys to be replayed don t retransmit automatically on 0-RTT reject, but let application decide in theory: can be okay for some requests? (HTTP GET?) in practice: unclear / will have to see... browsers already routinely retry some HTTP requests July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 16
21 Multi-Stage Key Exchange (Security) with replayable stages/keys corruption pk B, sk A eavesdropping semi-static reveal key K i reveal active attacks pk A, sk B KE semi-static server sk??? K 1 K 1 K 1 $ test K i K 2 K 2... replayable stage/key July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 17
22 Security of the draft-12 (EC)DHE 0-RTT Handshake semi-static server pk = g s Client (earlier full handshake) Server semi-static server sk = s tk ehs tk ead ClientHello ClientKeyShare (ClientFinished 0 ) tk ehs tk ead 0-RTT data 0-RTT data 0-RTT keys tk ehs, tk ead (& data) can be replayed weaker forward secrecy guarantees ServerHello ServerKeyShare... July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 18
23 (Still) Not the End of the Story TLS WG decided (in April) to only support PSK-based 0-RTT... but (EC)DHE-based 0-RTT might come back as extension, esp. for better forward secrecy our model can serve as stepping stone for understanding 0-RTT & replays... and can be applied to PSK-based 0-RTT as well (we currently look into that, security results appear to be similar) July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 19
24 Summary We analyze TLS 1.3 (draft-10) full (EC)DHE, PSK, and PSK-DHE handshake in an extended multi-stage key exchange model Client ClientHello ClientKeyShare Server ServerHello ServerKeyShare for 0-RTT, distinguish KE level from (unpreventable) application level 0-RTT KE msg (n, g x ) 0-RTT data "/buy-something" process "/buy-s.. accept 0-RTT, KE response (g y ) enforce state loss (e.g., reboot) replay 0-RTT KE msg (n, g x ) replay "/buy-s.. reject 0-RTT, KE response msg (g y ) complete KE rej. after state loss for security reasons establish TLS 1.3 (draft-12) (EC)DHE 0-RTT handshake is secure multi-stage KE with replayable 0-RTT keys (resend) "/buy-something" under final key process "/buy-s.. again are looking into TLS 1.3 PSK-based 0-RTT handshake July 4, 2016 Secure Key Exchange and Channel Protocols Workshop (SKECH2), Bertinoro, Italy Felix Günther (TU Darmstadt) 20 Thank You!
A Cryptographic Analysis of the TLS 1.3 Handshake Protocol Candidates. Felix Günther. Technische Universität Darmstadt, Germany
A Cryptographic Analysis of the TLS 1.3 Handshake Protocol Candidates Felix Günther Technische Universität Darmstadt, Germany joint work with Benjamin Dowling, Marc Fischlin, and Douglas Stebila April
A Cryptographic Analysis of the TLS 1.3 draft-10 Full and Pre-shared Key Handshake Protocol. Felix Günther. Technische Universität Darmstadt, Germany
A Cryptographic Analysis of the TLS 1.3 draft-10 Full and Pre-shared Key Handshake Protocol Felix Günther Technische Universität Darmstadt, Germany joint work with Benjamin Dowling, Marc Fischlin, and
Part III TLS 1.3 and other Protocols
Part III TLS 1.3 and other Protocols 8th BIU Winter School on Key Exchange, 2018 Marc Fischlin 13. Oktober 2010 Dr.Marc Fischlin Kryptosicherheit 1 Marc Fischlin BIU Winter School 2018 2 TLS 1.3 Development
TLS 1.3. Eric Rescorla Mozilla IETF 92 TLS 1
TLS 1.3 Eric Rescorla Mozilla ekr@rtfm.com IETF 92 TLS 1 Changes since -03 draft-05 Prohibit SSL negotiation for backwards compatibility. Fix which MS is used for exporters. draft-04 Modify key computations
TLS 1.3: A Collision of Implementation, Standards, and Cryptography
TLS 1.3: A Collision of Implementation, Standards, and Cryptography Eric Rescorla Mozilla ekr@rtfm.com TLS 1.3 1 TLS 1.3 Objectives Clean up: Remove unused or unsafe features Security: Improve security
Coming of Age: A Longitudinal Study of TLS Deployment
Coming of Age: A Longitudinal Study of TLS Deployment Accepted at ACM Internet Measurement Conference (IMC) 2018, Boston, MA, USA Platon Kotzias, Abbas Razaghpanah, Johanna Amann, Kenneth G. Paterson,
Overview of TLS v1.3 What s new, what s removed and what s changed?
Overview of TLS v1.3 What s new, what s removed and what s changed? About Me Andy Brodie Solution Architect / Principal Design Engineer. On Worldpay ecommerce Payment Gateways. Based in Cambridge, UK.
MTAT Applied Cryptography
MTAT.07.017 Applied Cryptography Transport Layer Security (TLS) Advanced Features University of Tartu Spring 2016 1 / 16 Client Server Authenticated TLS ClientHello ServerHello, Certificate, ServerHelloDone
Replay Attacks on Zero Round-Trip Time: The Case of the TLS 1.3 Handshake Candidates
A preliminary version of this paper appears in the proceedings of the 2nd IEEE European Symposium on Security and Privacy (EuroS&P 2017). This is the full version. Replay Attacks on Zero Round-Trip Time:
Auth. Key Exchange. Dan Boneh
Auth. Key Exchange Review: key exchange Alice and want to generate a secret key Saw key exchange secure against eavesdropping Alice k eavesdropper?? k This lecture: Authenticated Key Exchange (AKE) key
THE WORLD OF TLS. Security, Attacks, TLS 1.3
THE WORLD OF TLS Security, Attacks, TLS 1.3 HTTPS:// AND FTPS:// AND. Have you done any of the following today? E-shopping: Amazon, Ebay, Audible, Checked your Email Visited a social networking site: Facebook,
Transport Layer Security
Cryptography and Security in Communication Networks Transport Layer Security ETTI - Master - Advanced Wireless Telecommunications Secure channels Secure data delivery on insecure networks Create a secure
OPTLS and TLS 1.3. Hugo Krawczyk, Hoeteck Wee. TRON Workshop 2/21/2016
OPTLS and TLS 1.3 Hugo Krawczyk, Hoeteck Wee TRON Workshop 2/21/2016 1 Plan Explain OPTLS approach and modes (handshake only) Highlight protocol concept and simplicity Common logic to all protocol modes
Formally Analyzing the TLS 1.3 proposal
Bachelor Thesis Formally Analyzing the TLS 1.3 proposal Student: Vincent Stettler Student ID: 12-932-661 Supervisor: Ralf Sasse Professor: David Basin Submission date: 03.07.2016 Abstract The goal of this
Overview of TLS v1.3. What s new, what s removed and what s changed?
Overview of TLS v1.3 What s new, what s removed and what s changed? About Me Andy Brodie Worldpay Principal Design Engineer. Based in Cambridge, UK. andy.brodie@owasp.org Neither a cryptographer nor a
Securely Deploying TLS 1.3. September 2017
Securely Deploying TLS 1.3 September 2017 Agenda Why TLS 1.3? Zero Round Trip Time (0-RTT) requests Forward secrecy Resumption key management Why TLS 1.3? Speed TLS impacts latency, not thoroughput Protocol
Part II Bellare-Rogaway Model (Active Adversaries)
Part II Bellare-Rogaway Model (Active Adversaries) 8th BIU Winter School on Key Exchange, 2018 Marc Fischlin 13. Oktober 2010 Dr.Marc Fischlin Kryptosicherheit 1 Active Attacks Adversary may tamper, drop,
Understand the TLS handshake Understand client/server authentication in TLS. Understand session resumption Understand the limitations of TLS
Last Updated: Oct 31, 2017 Understand the TLS handshake Understand client/server authentication in TLS RSA key exchange DHE key exchange Explain certificate ownership proofs in detail What cryptographic
Universität Hamburg. SSL & Company. Fachbereich Informatik SVS Sicherheit in Verteilten Systemen. Security in TCP/IP. UH, FB Inf, SVS, 18-Okt-04 2
Universität Hamburg SSL & Company Fachbereich Informatik SVS Sicherheit in Verteilten Systemen Security in TCP/IP UH, FB Inf, SVS, 18-Okt-04 2 SSL/TLS Overview SSL/TLS provides security at TCP layer. Uses
Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE i, IEEE 802.1X P2.
P2 Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE 802.11i, IEEE 802.1X P2.2 IP Security IPsec transport mode (host-to-host), ESP and
ON THE SECURITY OF TLS RENEGOTIATION
ON THE SECURITY OF TLS RENEGOTIATION 2012/11/02 QUT Douglas Stebila European Network of Excellence in Cryptology II (ECRYPT II) Australian Technology Network German Academic Exchange Service (ATN-DAAD)
Authenticated Encryption in TLS
Authenticated Encryption in TLS Same modelling & verification approach concrete security: each lossy step documented by a game and a reduction (or an assumption) on paper Standardized complications - multiple
TLS1.2 IS DEAD BE READY FOR TLS1.3
TLS1.2 IS DEAD BE READY FOR TLS1.3 28 March 2017 Enterprise Architecture Technology & Operations Presenter Photo Motaz Alturayef Jubial Cyber Security Conference 70% Privacy and security concerns are
State of TLS usage current and future. Dave Thompson
State of TLS usage current and future Dave Thompson TLS Client/Server surveys Balancing backward compatibility with security. As new vulnerabilities are discovered, when can we shutdown less secure TLS
Chapter 4: Securing TCP connections
Managing and Securing Computer Networks Guy Leduc Chapter 5: Securing TCP connections Computer Networking: A Top Down Approach, 6 th edition. Jim Kurose, Keith Ross Addison-Wesley, March 2012. (section
History. TLS 1.3 Draft 26 Supported in TMOS v14.0.0
PRESENTED BY: History SSL developed by Netscape SSLv1.0 Never released SSLv2.0 1995 SSLv3.0 1996 Moved governance to the IETF and renamed TLS TLSv1.0 1999 TLSv1.1 2006 TLSv1.2 2008 TLSv1.3 2018 TLS 1.3
Computer Security 3e. Dieter Gollmann. Security.di.unimi.it/sicurezza1415/ Chapter 16: 1
Computer Security 3e Dieter Gollmann Security.di.unimi.it/sicurezza1415/ Chapter 16: 1 Chapter 16: Communications Security Chapter 16: 2 Agenda Threat model Secure tunnels Protocol design principles IPsec
What s new in TLS 1.3 (and OpenSSL as a result) Rich Salz
What s new in TLS 1.3 (and OpenSSL as a result) Rich Salz Timeline TLS 1.0 RFC 2246 January 1999 TLS 1.1 RFC 4346 April 2006 TLS 1.2 RFC 5246 August 2008 a whole bunch of RFC s for new crypto, secure renegotiation,
The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to
1 The World Wide Web is widely used by businesses, government agencies, and many individuals. But the Internet and the Web are extremely vulnerable to compromises of various sorts, with a range of threats
Introduction to cryptology (GBIN8U16) Introduction
Introduction to cryptology (GBIN8U16) Introduction Pierre Karpman pierre.karpman@univ-grenoble-alpes.fr https://www-ljk.imag.fr/membres/pierre.karpman/tea.html 2018 01 24 Introduction 2018 01 24 1/27 First
TLS 1.3 Extension for Certificate-based Authentication with an External Pre-Shared Key
TLS 1.3 Extension for Certificate-based Authentication with an External Pre-Shared Key draft-housley-tls-tls13-cert-with-extern-psk Russ Housley TLS WG at IETF 102 July 2018 TLS 1.3 Authentication and
TLS 1.3. Eric Rescorla Mozilla draft-ietf-tls-tls13-21 IETF 100 TLS 1
TLS 1.3 draft-ietf-tls-tls13-21 Eric Rescorla Mozilla ekr@rtfm.com IETF 100 TLS 1 Agenda Middlebox issues (PR#1091) close_notify and half-close (PR#1092) SNI and resumption(pr#1080) IETF 100 TLS 2 Middlebox
Lehrstuhl für Netzarchitekturen und Netzdienste Fakultät für Informatik Technische Universität München. ilab. Lab 8 SSL/TLS and IPSec
Lehrstuhl für Netzarchitekturen und Netzdienste Fakultät für Informatik Technische Universität München ilab Lab 8 SSL/TLS and IPSec Outlook: On Layer 4: Goal: Provide security for one specific port SSL
Real-time protocol. Chapter 16: Real-Time Communication Security
Chapter 16: Real-Time Communication Security Mohammad Almalag Dept. of Computer Science Old Dominion University Spring 2013 1 Real-time protocol Parties negotiate interactively (Mutual) Authentication
IPsec and SSL/TLS. Applied Cryptography. Andreas Hülsing (Slides mostly by Ruben Niederhagen) Dec. 1st, /43
0/43 IPsec and SSL/TLS Applied Cryptography 0 Andreas Hülsing (Slides mostly by Ruben Niederhagen) Dec. 1st, 2016 Cryptography in the TCP/IP stack application layer transport layer network layer data-link
Security Protocols and Infrastructures
Security Protocols and Infrastructures Dr. Michael Schneider michael.schneider@h-da.de Chapter 8: The Transport Layer Security Protocol (TLS) December 4, 2017 h_da WS2017/18 Dr. Michael Schneider 1 1 Overview
Security Protocols and Infrastructures. Winter Term 2010/2011
Winter Term 2010/2011 Chapter 4: Transport Layer Security Protocol Contents Overview Record Protocol Cipher Suites in TLS 1.2 Handshaking Protocols Final Discussion 2 Contents Overview Record Protocol
Solving HTTP Problems With Code and Protocols NATASHA ROONEY
Solving HTTP Problems With Code and Protocols NATASHA ROONEY Web HTTP TLS TCP IP 7. Application Data HTTP / IMAP 6. Data Presentation, Encryption SSL / TLS 5. Session and connection management - 4. Transport
Transport Layer Security
CEN585 Computer and Network Security Transport Layer Security Dr. Mostafa Dahshan Department of Computer Engineering College of Computer and Information Sciences King Saud University mdahshan@ksu.edu.sa
Network Security: TLS/SSL. Tuomas Aura T Network security Aalto University, Nov-Dec 2014
Network Security: TLS/SSL Tuomas Aura T-110.5241 Network security Aalto University, Nov-Dec 2014 Outline 1. Diffie-Hellman key exchange (recall from earlier) 2. Key exchange using public-key encryption
Cryptology complementary. Introduction
Cryptology complementary ] Introduction Pierre Karpman pierre.karpman@univ-grenoble-alpes.fr https://www-ljk.imag.fr/membres/pierre.karpman/tea.html 2018 02 08 Introduction 2018 02 08 1/21 First things
Requirements from the. Functional Package for Transport Layer Security (TLS)
Requirements from the Functional Package for Transport Layer Security (TLS) Version: 1.0 2018-12-17 National Information Assurance Partnership Revision History Version Date Comment Introduction Purpose.
Security Protocols. Professor Patrick McDaniel CSE545 - Advanced Network Security Spring CSE545 - Advanced Network Security - Professor McDaniel
Security Protocols Professor Patrick McDaniel CSE545 - Advanced Network Security Spring 2011 CSE545 - Advanced Network Security - Professor McDaniel 1 Case Study: Host Access The first systems used telnet
CSCE 715: Network Systems Security
CSCE 715: Network Systems Security Chin-Tser Huang huangct@cse.sc.edu University of South Carolina Web Security Web is now widely used by business, government, and individuals But Internet and Web are
Computer Security. 10r. Recitation assignment & concept review. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 10r. Recitation assignment & concept review Paul Krzyzanowski Rutgers University Spring 2018 April 3, 2018 CS 419 2018 Paul Krzyzanowski 1 1. What is a necessary condition for perfect
The Road to TLS 1.3. Eric Rescorla Mozilla The Road to TLS 1.3 1
The Road to TLS 1.3 Eric Rescorla Mozilla ekr@rtfm.com The Road to TLS 1.3 1 Overview How we got to the point of doing TLS 1.3 Overview of TLS 1.3 Interaction with the real world What can we learn? The
Internet security and privacy
Internet security and privacy SSL/TLS 1 Application layer App. TCP/UDP IP L2 L1 2 Application layer App. SSL/TLS TCP/UDP IP L2 L1 3 History of SSL/TLS Originally, SSL Secure Socket Layer, was developed
Security Protocols and Infrastructures. Winter Term 2015/2016
Winter Term 2015/2016 Nicolas Buchmann (Harald Baier) Chapter 8: Transport Layer Security Protocol Key Questions Application context of TLS? Which security goals shall be achieved? Approaches? 2 Contents
L13. Reviews. Rocky K. C. Chang, April 10, 2015
L13. Reviews Rocky K. C. Chang, April 10, 2015 1 Foci of this course Understand the 3 fundamental cryptographic functions and how they are used in network security. Understand the main elements in securing
SharkFest 17 Europe. SSL/TLS Decryption. uncovering secrets. Wednesday November 8th, Peter Wu Wireshark Core Developer
SharkFest 17 Europe SSL/TLS Decryption uncovering secrets Wednesday November 8th, 2017 Peter Wu Wireshark Core Developer peter@lekensteyn.nl 1 About me Wireshark contributor since 2013, core developer
IPsec (AH, ESP), IKE. Guevara Noubir CSG254: Network Security
IPsec (AH, ESP), IKE Guevara Noubir noubir@ccs.neu.edu Securing Networks Control/Management (configuration) Applications Layer telnet/ftp: ssh, http: https, mail: PGP (SSL/TLS) Transport Layer (TCP) (IPSec,
Data Security and Privacy. Topic 14: Authentication and Key Establishment
Data Security and Privacy Topic 14: Authentication and Key Establishment 1 Announcements Mid-term Exam Tuesday March 6, during class 2 Need for Key Establishment Encrypt K (M) C = Encrypt K (M) M = Decrypt
Preventing Attackers From Using Verifiers: A-PAKE With PK-Id
Preventing Attackers From Using Verifiers: A-PAKE With PK-Id Sean Parkinson (sean.parkinson@rsa.com) RSA, The Security Division of EMC Session ID: ARCH R02 Session Classification: Advanced Outline Introduction
Using EAP-TLS with TLS 1.3 draft-mattsson-eap-tls IETF 101, EMU, MAR John Mattsson, MOHIT sethi
Using EAP-TLS with TLS 1.3 draft-mattsson-eap-tls13-02 IETF 101, EMU, MAR 19 2018 John Mattsson, MOHIT sethi draft-mattsson-eap-tls13 EAP-TLS is widely supported for authentication in Wi-Fi. EAP-TLS is
Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010
Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Photuris and SKIP PHASE 1 IKE PHASE 2 IKE How is SA established? How do parties negotiate
CS 494/594 Computer and Network Security
CS 494/594 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2010 1 Real-Time Communication Security Network layers
Computer Security 3e. Dieter Gollmann. Security.di.unimi.it/sicurezza1516/ Chapter 16: 1
Computer Security 3e Dieter Gollmann Security.di.unimi.it/sicurezza1516/ Chapter 16: 1 Chapter 16: Communications Security Chapter 16: 2 Agenda Threat model Secure tunnels Protocol design principles IPsec
Protecting TLS from Legacy Crypto
Protecting TLS from Legacy Crypto http://mitls.org Karthikeyan Bhargavan + many, many others. (INRIA, Microsoft Research, LORIA, IMDEA, Univ of Pennsylvania, Univ of Michigan, JHU) Popular cryptographic
Randomness Extractors. Secure Communication in Practice. Lecture 17
Randomness Extractors. Secure Communication in Practice Lecture 17 11:00-12:30 What is MPC? Manoj Monday 2:00-3:00 Zero Knowledge Muthu 3:30-5:00 Garbled Circuits Arpita Yuval Ishai Technion & UCLA 9:00-10:30
Linkable Message Tagging Solving the Key Distribution Problem of Signature Schemes Felix Günther
Linkable Message Tagging Solving the Key Distribution Problem of Signature Schemes Felix Günther Technische Universität Darmstadt Germany Bertram Poettering Ruhr-Universität Bochum Germany June 30, 2015
Securing IoT applications with Mbed TLS Hannes Tschofenig Arm Limited
Securing IoT applications with Mbed TLS Hannes Tschofenig Agenda Theory Threats Security services Hands-on with Arm Keil MDK Pre-shared secret-based authentication (covered in webinar #1) TLS Protocol
WAP Security. Helsinki University of Technology S Security of Communication Protocols
WAP Security Helsinki University of Technology S-38.153 Security of Communication Protocols Mikko.Kerava@iki.fi 15.4.2003 Contents 1. Introduction to WAP 2. Wireless Transport Layer Security 3. Other WAP
SSL/TLS & 3D Secure. CS 470 Introduction to Applied Cryptography. Ali Aydın Selçuk. CS470, A.A.Selçuk SSL/TLS & 3DSec 1
SSL/TLS & 3D Secure CS 470 Introduction to Applied Cryptography Ali Aydın Selçuk CS470, A.A.Selçuk SSL/TLS & 3DSec 1 SSLv2 Brief History of SSL/TLS Released in 1995 with Netscape 1.1 Key generation algorithm
Verifying Real-World Security Protocols from finding attacks to proving security theorems
Verifying Real-World Security Protocols from finding attacks to proving security theorems Karthik Bhargavan http://prosecco.inria.fr + many co-authors at INRIA, Microsoft Research, Formal security analysis
Expires: September 10, 2015 Inria Paris-Rocquencourt A. Langley Google Inc. M. Ray Microsoft Corp. March 9, 2015
Network Working Group Internet-Draft Expires: September 10, 2015 K. Bhargavan A. Delignat-Lavaud A. Pironti Inria Paris-Rocquencourt A. Langley Google Inc. M. Ray Microsoft Corp. March 9, 2015 Transport
Security analysis of DTLS 1.2 implementations
Bachelor thesis Computing Science Radboud University Security analysis of DTLS 1.2 implementations Author: Niels van Drueten s4496604 First supervisor/assessor: dr.ir. Joeri de Ruiter joeri@cs.ru.nl Second
for Compound Authentication
Verified Contributive Channel Bindings for Compound Authentication Antoine Delignat-Lavaud, Inria Paris Joint work with Karthikeyan Bhargavan and Alfredo Pironti Motivation: Authentication Composition
Network Security: TLS/SSL. Tuomas Aura T Network security Aalto University, Nov-Dec 2010
Network Security: TLS/SSL Tuomas Aura T-110.5240 Network security Aalto University, Nov-Dec 2010 Outline 1. Diffie-Hellman 2. Key exchange using public-key encryption 3. Goals of authenticated key exchange
Secure Socket Layer. Security Threat Classifications
Secure Socket Layer 1 Security Threat Classifications One way to classify Web security threats in terms of the type of the threat: Passive threats Active threats Another way to classify Web security threats
CS 356 Internet Security Protocols. Fall 2013
CS 356 Internet Security Protocols Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5
Cryptography and Network Security Chapter 16. Fourth Edition by William Stallings
Cryptography and Network Security Chapter 16 Fourth Edition by William Stallings Chapter 16 IP Security If a secret piece of news is divulged by a spy before the time is ripe, he must be put to death,
E-commerce security: SSL/TLS, SET and others. 4.1
E-commerce security: SSL/TLS, SET and others. 4.1 1 Electronic payment systems Purpose: facilitate the safe and secure transfer of monetary value electronically between multiple parties Participating parties:
nquic: Noise-Based QUIC Packet Protection
nquic: Noise-Based QUIC Packet Protection Mathias Hall-Andersen *, David Wong *, Nick Sullivan +, and Alishah Chator + Abstract * NCC Group + Cloudflare January 12, 2019 We present nquic, a variant of
Network Working Group Requests for Commments: 2716 Category: Experimental October 1999
Network Working Group Requests for Commments: 2716 Category: Experimental B. Aboba D. Simon Microsoft October 1999 Status of this Memo PPP EAP TLS Authentication Protocol This memo defines an Experimental
SECURITY & PRIVACY IN 3G/4G/ 5G NETWORKS: THE AKA PROTOCOL WITH S.ALT, P.-A. FOUQUE, G. MACARIO-RAT, B. RICHARD
SECURITY & PRIVACY IN 3G/4G/ 5G NETWORKS: THE AKA PROTOCOL WITH S.ALT, P.-A. FOUQUE, G. MACARIO-RAT, B. RICHARD ME, MYSELF, AND EMSEC Ø BSc. & MSc. Mathematics, TU Eindhoven Master thesis on multiparty
Message authentication codes
Message authentication codes Martin Stanek Department of Computer Science Comenius University stanek@dcs.fmph.uniba.sk Cryptology 1 (2017/18) Content Introduction security of MAC Constructions block cipher
Network Security - ISA 656 IPsec IPsec Key Management (IKE)
Network Security - ISA 656 IPsec IPsec (IKE) Angelos Stavrou September 28, 2008 What is IPsec, and Why? What is IPsec, and Why? History IPsec Structure Packet Layout Header (AH) AH Layout Encapsulating
Lecture for February 10, 2016
Lecture for February 10, 2016 ECS 235A UC Davis Matt Bishop February 10, 2016 ECS 235A, Matt Bishop Slide #1 Supporting Crypto All parts of SSL use them Initial phase: public key system exchanges keys
Preparing for post-quantum cryptography in TLS
Preparing for post-quantum cryptography in TLS Douglas Stebila Funding acknowledgements: TLS:DIV workshop April 30, 2017 TLS:DIV 2017-04-30 Preparing for post-quantum cryptography in TLS Douglas Stebila
Cryptography (Overview)
Cryptography (Overview) Some history Caesar cipher, rot13 substitution ciphers, etc. Enigma (Turing) Modern secret key cryptography DES, AES Public key cryptography RSA, digital signatures Cryptography
CSE484 Final Study Guide
CSE484 Final Study Guide Winter 2013 NOTE: This study guide presents a list of ideas and topics that the TAs find useful to know, and may not represent all the topics that could appear on the final exam.
A messy state of the union:
A messy state of the union: Taming the Composite State Machines of TLS http://smacktls.com Benjamin Beurdouche, Karthikeyan Bhargavan, Antoine Delignat-Lavaud, Cédric Fournet, Markulf Kohlweiss, Alfredo
Chapter 7. WEB Security. Dr. BHARGAVI H. GOSWAMI Department of Computer Science Christ University
Chapter 7 WEB Security Dr. BHARGAVI H. GOSWAMI Department of Computer Science Christ University +91 9426669020 bhargavigoswami@gmail.com Topic List 1. Web Security Considerations 2. Secure Socket Layer
8. Network Layer Contents
Contents 1 / 43 * Earlier Work * IETF IP sec Working Group * IP Security Protocol * Security Associations * Authentication Header * Encapsulation Security Payload * Internet Key Management Protocol * Modular
CIS 6930/4930 Computer and Network Security. Topic 8.2 Internet Key Management
CIS 6930/4930 Computer and Network Security Topic 8.2 Internet Key Management 1 Key Management Why do we need Internet key management AH and ESP require encryption and authentication keys Process to negotiate
VPN Overview. VPN Types
VPN Types A virtual private network (VPN) connection establishes a secure tunnel between endpoints over a public network such as the Internet. This chapter applies to Site-to-site VPNs on Firepower Threat
Internet Engineering Task Force (IETF) ISSN: January Suite B Profile for Transport Layer Security (TLS)
Internet Engineering Task Force (IETF) M. Salter Request for Comments: 6460 National Security Agency Obsoletes: 5430 R. Housley Category: Informational Vigil Security ISSN: 2070-1721 January 2012 Abstract
Lecture 5: Protocols - Authentication and Key Exchange* CS 392/6813: Computer Security Fall Nitesh Saxena
Lecture 5: Protocols - Authentication and Key Exchange* CS 392/6813: Computer Security Fall 2009 Nitesh Saxena *Adopted from a previous lecture by Gene Tsudik Course Admin HW3 Problem 3 due Friday midnight
MTAT Applied Cryptography
MTAT.07.017 Applied Cryptography Transport Layer Security (TLS) University of Tartu Spring 2017 1 / 22 Transport Layer Security TLS is cryptographic protocol that provides communication security over the
Application Layer Transport Security. Cesar Ghali, Adam Stubblefield, Ed Knapp, Jiangtao Li, Benedikt Schmidt, Julien Boeuf
Application Layer Transport Security Cesar Ghali, Adam Stubblefield, Ed Knapp, Jiangtao Li, Benedikt Schmidt, Julien Boeuf Table of Contents Executive summary 1 1. Introduction 2 2. Application-Level Security
Symmetric Encryption 2: Integrity
http://wwmsite.wpengine.com/wp-content/uploads/2011/12/integrity-lion-300x222.jpg Symmetric Encryption 2: Integrity With material from Dave Levin, Jon Katz, David Brumley 1 Summing up (so far) Computational
Cryptography. and Network Security. Lecture 0. Manoj Prabhakaran. IIT Bombay
Cryptography and Network Security Lecture 0 Manoj Prabhakaran IIT Bombay Security In this course: Cryptography as used in network security Humans, Societies, The World Network Hardware OS Libraries Programs
CIP Security Phase 1 Secure Transport for EtherNet/IP
CIP Security Phase 1 Secure Transport for EtherNet/IP Brian Batke, Rockwell Automation Dennis Dubé, Schneider Electric Joakim Wiberg, HMS Industrial Networks October 14, 2015 The Need for a Secure Transport
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ Chapter 8 Network Security Computer Networking: A Top Down Approach, 5 th edition. Jim Kurose, Keith Ross Addison-Wesley, April 2009.
A Framework for Universally Composable Diffie-Hellman Key Exchange
A Framework for Universally Composable Diffie-Hellman Key Exchange Ralf Küsters and Daniel Rausch University of Stuttgart Stuttgart, Germany Email: {ralf.kuesters, daniel.rausch}@informatik.uni-stuttgart.de
Internet Engineering Task Force (IETF) Request for Comments: Google Inc. October 2018
Internet Engineering Task Force (IETF) Request for Comments: 8472 Category: Standards Track ISSN: 2070-1721 A. Popov, Ed. M. Nystroem Microsoft Corp. D. Balfanz Google Inc. October 2018 Transport Layer
Configuring SSL. SSL Overview CHAPTER
CHAPTER 8 Date: 4/23/09 This topic describes the steps required to configure your ACE (both the ACE module and the ACE appliance) as a virtual Secure Sockets Layer (SSL) server for SSL initiation or termination.
The Xirrus Wi Fi Array XS4, XS8 Security Policy Document Version 1.0. Xirrus, Inc.
The Xirrus Wi Fi Array XS4, XS8 Security Policy Document Version 1.0 Xirrus, Inc. March 8, 2011 Copyright Xirrus, Inc. 2011. May be reproduced only in its original entirety [without revision]. Page 1 TABLE
Group Key Establishment Protocols
Group Key Establishment Protocols Ruxandra F. Olimid EBSIS Summer School on Distributed Event Based Systems and Related Topics 2016 July 14, 2016 Sinaia, Romania Outline 1. Context and Motivation 2. Classifications
CS 393 Network Security. Nasir Memon Polytechnic University Module 12 SSL
CS 393 Network Security Nasir Memon Polytechnic University Module 12 SSL Course Logistics HW 4 due today. HW 5 will be posted later today. Due in a week. Group homework. DoD Scholarships? NSF Scholarships?