SSL/TLS: The Ugly Truth
|
|
|
- Steven Goodman
- 10 years ago
- Views:
Transcription
1 SSL/TLS: The Ugly Truth Examining the flaws in SSL/TLS protocols, and the use of certificate authorities. Adrian Hayter CNS Hut 3 Team [email protected]
2 Contents Introduction to SSL/TLS Cryptography Crash Course Certificates Weaknesses in SSL/TLS The Certificate Authority System Solutions & Recommendations Questions Adrian Hayter Page: 2/26
3 What is SSL/TLS? Secure Sockets Layer (versions 2.0, 3.0) Transport Layer Security (versions 1.0, 1.1, 1.2) Cryptographic protocols that allow secure communication over a network. Uses: Authentication of participants. Key exchange. Encryption of data. Data integrity. Adrian Hayter Page: 3/26
4 What is SSL/TLS? Secure Sockets Layer (versions 2.0, 3.0) Transport Layer Security (versions 1.0, 1.1, 1.2) Cryptographic protocols that allow secure communication over a network. Uses: Authentication of participants. Key exchange. Encryption of data. Data integrity. Adrian Hayter Page: 3/26
5 Cryptography Crash Course If you already know about cryptography, feel free to ignore the next few slides! Adrian Hayter Page: 4/26
6 Cryptography Crash Course: Symmetric Cryptography Alice Bob Alice and Bob both have a copy of a secret key. Alice encrypts a message using the secret key and sends it to Bob. Bob decrypts the message using the secret key. Bob encrypts a message using the secret key and sends it to Alice. Alice decrypts the message using the secret key. Adrian Hayter Page: 5/26
7 Cryptography Crash Course: Symmetric Cryptography Encryption / Decryption is simple and easy for a computer to do. Secret keys are also easy to generate. Requires participants to have set up the shared secret key beforehand. Problems: How do participants set up a shared secret key? What if the participants don t know each other? Adrian Hayter Page: 6/26
8 Cryptography Crash Course: Symmetric Cryptography Encryption / Decryption is simple and easy for a computer to do. Secret keys are also easy to generate. Requires participants to have set up the shared secret key beforehand. Problems: How do participants set up a shared secret key? What if the participants don t know each other? Adrian Hayter Page: 6/26
9 Cryptography Crash Course: Asymmetric Cryptography Alice Bob Alice and Bob generate their own private and public key pairs. Alice and Bob share their public keys with each other. Alice encrypts a message with Bob's public key and sends it to Bob. Bob decrypts the message with his private key. Bob encrypts a message with Alice's public key and sends it to Alice. Alice decrypts the message with her private key. Adrian Hayter Page: 7/26
10 Cryptography Crash Course: Asymmetric Cryptography Asymmetric Cryptography is also known as Public-key Cryptography. Public / Private keys are mathematically linked. Knowledge of one of the keys does not compromise the other. Does not require the participants to have set up any shared secrets beforehand, or even know each other. Problem: Both the key pair generation and the encryption / decryption processes are complex and take much longer for computers to do than with symmetric cryptography. Adrian Hayter Page: 8/26
11 Cryptography Crash Course: Asymmetric Cryptography Asymmetric Cryptography is also known as Public-key Cryptography. Public / Private keys are mathematically linked. Knowledge of one of the keys does not compromise the other. Does not require the participants to have set up any shared secrets beforehand, or even know each other. Problem: Both the key pair generation and the encryption / decryption processes are complex and take much longer for computers to do than with symmetric cryptography. Adrian Hayter Page: 8/26
12 A Solution We can combine symmetric and asymmetric cryptography..1 Alice & Bob generate public/private keys beforehand..2 When Alice wants to send a message to Bob, she asks Bob to send her his public key..3 Bob sends Alice his public key..4 Alice creates a symmetric key, encrypts it using Bob s public key, and sends the encrypted key to Bob..5 Bob decrypts the symmetric key using his private key and stores it..6 Alice and Bob can now encrypt/decrypt messages using the shared symmetric key. Adrian Hayter Page: 9/26
13 A Solution We can combine symmetric and asymmetric cryptography..1 Alice & Bob generate public/private keys beforehand..2 When Alice wants to send a message to Bob, she asks Bob to send her his public key..3 Bob sends Alice his public key..4 Alice creates a symmetric key, encrypts it using Bob s public key, and sends the encrypted key to Bob..5 Bob decrypts the symmetric key using his private key and stores it..6 Alice and Bob can now encrypt/decrypt messages using the shared symmetric key. Adrian Hayter Page: 9/26
14 A Solution We can combine symmetric and asymmetric cryptography..1 Alice & Bob generate public/private keys beforehand..2 When Alice wants to send a message to Bob, she asks Bob to send her his public key..3 Bob sends Alice his public key..4 Alice creates a symmetric key, encrypts it using Bob s public key, and sends the encrypted key to Bob..5 Bob decrypts the symmetric key using his private key and stores it..6 Alice and Bob can now encrypt/decrypt messages using the shared symmetric key. Adrian Hayter Page: 9/26
15 A Solution We can combine symmetric and asymmetric cryptography..1 Alice & Bob generate public/private keys beforehand..2 When Alice wants to send a message to Bob, she asks Bob to send her his public key..3 Bob sends Alice his public key..4 Alice creates a symmetric key, encrypts it using Bob s public key, and sends the encrypted key to Bob..5 Bob decrypts the symmetric key using his private key and stores it..6 Alice and Bob can now encrypt/decrypt messages using the shared symmetric key. Adrian Hayter Page: 9/26
16 A Solution We can combine symmetric and asymmetric cryptography..1 Alice & Bob generate public/private keys beforehand..2 When Alice wants to send a message to Bob, she asks Bob to send her his public key..3 Bob sends Alice his public key..4 Alice creates a symmetric key, encrypts it using Bob s public key, and sends the encrypted key to Bob..5 Bob decrypts the symmetric key using his private key and stores it..6 Alice and Bob can now encrypt/decrypt messages using the shared symmetric key. Adrian Hayter Page: 9/26
17 A Solution We can combine symmetric and asymmetric cryptography..1 Alice & Bob generate public/private keys beforehand..2 When Alice wants to send a message to Bob, she asks Bob to send her his public key..3 Bob sends Alice his public key..4 Alice creates a symmetric key, encrypts it using Bob s public key, and sends the encrypted key to Bob..5 Bob decrypts the symmetric key using his private key and stores it..6 Alice and Bob can now encrypt/decrypt messages using the shared symmetric key. Adrian Hayter Page: 9/26
18 A problem with our solution! Alice and Bob don t ever verify that they are actually talking to each other! Adrian Hayter Page: 10/26
19 A problem with our solution! Alice and Bob don t ever verify that they are actually talking to each other! Man in the Middle Attack Alice Mallory Bob "Hey Bob, it's Alice. Can I have your public key?" "Hey Bob, it's Alice. Can I have your public key?" Bob sends his public key. Mallory sends his public key. How do we solve this problem? Adrian Hayter Page: 10/26
20 Certificates A digital certificate binds a public key to an identity using a digital signature. The digital signature almost always comes from a trusted third party. If the signature is trusted, the certificate is valid, and the public key is verified to belong to the specified identity. In the SSL/TLS system, X.509 certificates are signed by Certificate Authorities (e.g. VeriSign, Comodo, Entrust, PositiveSSL). More on these later... Adrian Hayter Page: 11/26
21 Certificate Fields Subject: The identity the public key belongs to (e.g. Bob, Issuer: The identity that signed and issued the certificate (e.g. VeriSign). Signature: The signature of the issuer. Not Before / Not After: Dates when the certificate is valid. Public Key: The subject s public key. Version, Serial Number, Signature Algorithm, Public Key Algorithm Adrian Hayter Page: 12/26
22 (Highly) Simplified SSL/TLS Handshake Client Server Client requests SSL/TLS connection. Sends some random bytes to the server. Server sends certificate. Sends some random bytes to the client. Client verifies certificate, generates pre-master secret, encrypts the secret with the server's public key, and sends it to the server. The server decrypts the pre-master secret and uses it to generate a shared master secret, which is then used to generate session keys. The client generates the same master secret and session keys. The client and server encrypt and exchange data using the session keys. Adrian Hayter Page: 13/26
23 SSL/TLS: Common Security Weaknesses Use of outdated protocols: SSLv2. Use of weak ciphers: symmetric encryption (<128 bits), asymmetric encryption (<2048 bits). Expired / invalid certificates. Self-signed certificates. Renegotiation. Web based: Login over HTTPS, everything else over HTTP (sslstrip exploits this). Adrian Hayter Page: 14/26
24 Attacks against SSL/TLS BEAST (Browser Exploit Against SSL/TLS) Developed in Affects all versions of SSL/TLS except TLS 1.1 and 1.2. Allows an attacker to perform a man-in-the-middle attack. CRIME (Compression Ratio Info-leak Made Easy) Developed in Affects all version of SSL and TLS. Allows an attacker to decrypt web cookies. Lucky Thirteen Attack Developed in Affects all versions of TLS. Allows an attacker to decrypt an intercepted message. Adrian Hayter Page: 15/26
25 The Certificate Authority System Web Browsers Root Certificate Authorities Intermediate Certificate Authorities Adrian Hayter Page: 16/26
26 The Certificate Authority System A certificate from an intermediate CA is trusted if there is a valid chain of trust all the way back to a root CA. Any certificate authority can issue and sign a certificate for any identity / public key. The system is only as secure as the weakest certificate authority. Adrian Hayter Page: 17/26
27 Attack Scenario.1 An attacker compromises the private (signing) key of a certificate authority..2 The attacker can now sign a certificate for the attacker s public key, with the identity google.com..3 A man-in-the-middle attack is now possible, as long as the compromised CA is continued to be trusted all the way back to a root CA. Note: This attack works even if a root CA (or any other CA) has signed a certificate for google.com s real public key! Adrian Hayter Page: 18/26
28 Case Study: DigiNotar DigiNotar was a Dutch root certificate authority, trusted by all major web browsers. On July 10th, 2011 a hacker gained access to DigiNotar s private signing key, and created a wildcard certificate for Google (*.google.com) using the hacker s public key. The certificate was used to perform man-in-the-middle attacks on web users in Iran before it was detected and revoked at the end of August. Adrian Hayter Page: 19/26
29 Case Study: DigiNotar (The Fallout) At least 531 other fraudulent certificates were found to have been issued by hackers using DigiNotar s compromised key. DigiNotar was removed as a root CA from all major web browsers. DigiNotar s intermediate CAs and all certificates they had signed were considered invalid due to the broken chain of trust. The company were declared bankrupt in September Adrian Hayter Page: 20/26
30 The Ugly Truth The ugly truth about SSL/TLS is that even with lots of clever cryptography being used, the current system we have for validating trust is based on often unknown third parties, with a single point of failure. How can we make certificate verification more secure? Adrian Hayter Page: 21/26
31 Convergence Convergence (unfortunately, no relation to CNS) was designed by security researcher Moxie Marlinspike. An agile, distributed, and secure strategy for replacing Certificate Authorities Relies on a number of network notaries to verify certificates, rather than a single CA. Resistant to most man-in-the-middle attacks. Adrian Hayter Page: 22/26
32 Convergence Server Cert B 5 5 Cert B Attacker Notary Cert A Is this cert Is this cert valid? valid? 3 Client 3 Notary 6 6 No! No! Adrian Hayter Page: 23/26
33 Convergence Advantages No single point of failure. Servers can self-sign certificates and still be trusted. Client has more control over the trust decision. Notaries can keep a cache of certificates (eliminating steps 4 and 5). Disadvantages Extra network traffic is required to verify a certificate. Still susceptible to some man-in-the-middle attacks. (Currently) not implemented well enough for wide adoption. Adrian Hayter Page: 24/26
34 Convergence Advantages No single point of failure. Servers can self-sign certificates and still be trusted. Client has more control over the trust decision. Notaries can keep a cache of certificates (eliminating steps 4 and 5). Disadvantages Extra network traffic is required to verify a certificate. Still susceptible to some man-in-the-middle attacks. (Currently) not implemented well enough for wide adoption. Adrian Hayter Page: 24/26
35 Recommendations Use TLS 1.0 (it s supported in all major web browsers). Use RC4 cipher suites (for now). Disable compression. Disable renegotiation. Play around with Convergence! Adrian Hayter Page: 25/26
36 Recommendations Use TLS 1.0 (it s supported in all major web browsers). Use RC4 cipher suites (for now). Disable compression. Disable renegotiation. Play around with Convergence! Adrian Hayter Page: 25/26
37 Questions? Ask away, or Adrian Hayter Page: 26/26
Web Security: Encryption & Authentication
Web Security: Encryption & Authentication Arnon Rungsawang [email protected] Massive Information & Knowledge Engineering Department of Computer Engineering Faculty of Engineering Kasetsart University, Bangkok,
Secure Sockets Layer (SSL) / Transport Layer Security (TLS)
Secure Sockets Layer (SSL) / Transport Layer Security (TLS) Brad Karp UCL Computer Science CS GZ03 / M030 19 th November 2014 What Problems Do SSL/TLS Solve? Two parties, client and server, not previously
SSL BEST PRACTICES OVERVIEW
SSL BEST PRACTICES OVERVIEW THESE PROBLEMS ARE PERVASIVE 77.9% 5.2% 19.2% 42.3% 77.9% of sites are HTTP 5.2% have an incomplete chain 19.2% support weak/insecure cipher suites 42.3% support SSL 3.0 83.1%
Understanding Digital Certificates and Secure Sockets Layer (SSL)
Understanding Digital Certificates and Secure Sockets Layer (SSL) Author: Peter Robinson January 2001 Version 1.1 Copyright 2001-2003 Entrust. All rights reserved. Digital Certificates What are they?
SSL and Browsers: The Pillars of Broken Security
SSL and Browsers: The Pillars of Broken Security Ivan Ristic Wolfgang Kandek Qualys, Inc. Session ID: TECH-403 Session Classification: Intermediate SSL, TLS, And PKI SSL (or TLS, if you prefer) is the
Chapter 17. Transport-Level Security
Chapter 17 Transport-Level Security Web Security Considerations The World Wide Web is fundamentally a client/server application running over the Internet and TCP/IP intranets The following characteristics
Lesson 10: Attacks to the SSL Protocol
Lesson 10: Attacks to the SSL Protocol Luciano Bello - [email protected] Chalmers University Dr. Alfonso Muñoz - [email protected] T>SIC Group. Universidad Politécnica de Madrid Security of the SSL
Overview of CSS SSL. SSL Cryptography Overview CHAPTER
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet, ensuring secure transactions such as the transmission of credit card numbers
Secure Socket Layer. Introduction Overview of SSL What SSL is Useful For
Secure Socket Layer Secure Socket Layer Introduction Overview of SSL What SSL is Useful For Introduction Secure Socket Layer (SSL) Industry-standard method for protecting web communications. - Data encryption
Overview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Note The information in this chapter applies to both the ACE module and the ACE appliance unless otherwise noted. The features in this chapter apply to IPv4 and IPv6 unless otherwise noted. Secure
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI) In this video you will learn the quite a bit about Public Key Infrastructure and how it is used to authenticate clients and servers. The purpose of Public Key Infrastructure
Securing the SSL/TLS channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs
OWASP AppSec APAC 2012 The OWASP Foundation http://www.owasp.org Securing the SSL/TLS channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and Pinning of Certs
Security. Contents. S-72.3240 Wireless Personal, Local, Metropolitan, and Wide Area Networks 1
Contents Security requirements Public key cryptography Key agreement/transport schemes Man-in-the-middle attack vulnerability Encryption. digital signature, hash, certification Complete security solutions
Secure Sockets Layer (SSL ) / Transport Layer Security (TLS) Network Security Products S31213
Secure Sockets Layer (SSL ) / Transport Layer Security (TLS) Network Security Products S31213 UNCLASSIFIED Example http ://www. greatstuf f. com Wants credit card number ^ Look at lock on browser Use https
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University
Digital Certificates (Public Key Infrastructure) Reshma Afshar Indiana State University October 2015 1 List of Figures Contents 1 Introduction 1 2 History 2 3 Public Key Infrastructure (PKI) 3 3.1 Certificate
You re FREE Guide SSL. (Secure Sockets Layer) webvisions www.webvisions.com +65 6868 1168 [email protected]
SSL You re FREE Guide to (Secure Sockets Layer) What is a Digital Certificate? SSL Certificates, also known as public key certificates or Digital Certificates, are essential to secure Internet browsing.
SBClient SSL. Ehab AbuShmais
SBClient SSL Ehab AbuShmais Agenda SSL Background U2 SSL Support SBClient SSL 2 What Is SSL SSL (Secure Sockets Layer) Provides a secured channel between two communication endpoints Addresses all three
3.2: Transport Layer: SSL/TLS Secure Socket Layer (SSL) Transport Layer Security (TLS) Protocol
Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Network Layer: IPSec Transport Layer: SSL/TLS Chapter 4: Security on the Application Layer Chapter 5: Security
Transport Layer Security Protocols
SSL/TLS 1 Transport Layer Security Protocols Secure Socket Layer (SSL) Originally designed to by Netscape to secure HTTP Version 2 is being replaced by version 3 Subsequently became Internet Standard known
Web Payment Security. A discussion of methods providing secure communication on the Internet. Zhao Huang Shahid Kahn
Web Payment Security A discussion of methods providing secure communication on the Internet Group Members: Peter Heighton Zhao Huang Shahid Kahn 1. Introduction Within this report the methods taken to
Is Your SSL Website and Mobile App Really Secure?
Is Your SSL Website and Mobile App Really Secure? Agenda What is SSL / TLS SSL Vulnerabilities PC/Server Mobile Advice to the Public Hong Kong Computer Emergency Response Team Coordination Centre 香 港 電
Using etoken for SSL Web Authentication. SSL V3.0 Overview
Using etoken for SSL Web Authentication Lesson 12 April 2004 etoken Certification Course SSL V3.0 Overview Secure Sockets Layer protocol, version 3.0 Provides communication privacy over the internet. Prevents
Introduction to Cryptography
Introduction to Cryptography Part 3: real world applications Jean-Sébastien Coron January 2007 Public-key encryption BOB ALICE Insecure M E C C D channel M Alice s public-key Alice s private-key Authentication
SSL A discussion of the Secure Socket Layer
www.harmonysecurity.com [email protected] SSL A discussion of the Secure Socket Layer By Stephen Fewer Contents 1 Introduction 2 2 Encryption Techniques 3 3 Protocol Overview 3 3.1 The SSL Record
Network Security Essentials Chapter 5
Network Security Essentials Chapter 5 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 5 Transport-Level Security Use your mentality Wake up to reality From the song, "I've Got
White Paper. Enhancing Website Security with Algorithm Agility
ENHANCING WEBSITE SECURITY WITH ALGORITHM AGILITY White Paper Enhancing Website Security with Algorithm Agility Enhancing Website Security with Algorithm Agility Contents Introduction 3 Encryption Today
SSL implementieren aber sicher!
SSL implementieren aber sicher! Karlsruher Entwicklertag 2014 21.05.2014 Dr. Yun Ding SSL in the news 2011 2012 2013 2014 BEAST CRIME Lucky 13 Compromised CAs RC4 biases BREACH DRBG Backdoor Apple goto
Secure Socket Layer/ Transport Layer Security (SSL/TLS)
Secure Socket Layer/ Transport Layer Security (SSL/TLS) David Sánchez Universitat Pompeu Fabra World Wide Web (www) Client/server services running over the Internet or TCP/IP Intranets nets widely used
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE. Mihir Bellare UCSD 1
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE Mihir Bellare UCSD 1 The public key setting Alice M D sk[a] (C) Bob pk[a] C C $ E pk[a] (M) σ $ S sk[a] (M) M, σ Vpk[A] (M, σ) Bob can: send encrypted data
Common security requirements Basic security tools. Example. Secret-key cryptography Public-key cryptography. Online shopping with Amazon
1 Common security requirements Basic security tools Secret-key cryptography Public-key cryptography Example Online shopping with Amazon 2 Alice credit card # is xxxx Internet What could the hacker possibly
SSL Server Rating Guide
SSL Server Rating Guide version 2009j (20 May 2015) Copyright 2009-2015 Qualys SSL Labs (www.ssllabs.com) Abstract The Secure Sockets Layer (SSL) protocol is a standard for encrypted network communication.
7 Key Management and PKIs
CA4005: CRYPTOGRAPHY AND SECURITY PROTOCOLS 1 7 Key Management and PKIs 7.1 Key Management Key Management For any use of cryptography, keys must be handled correctly. Symmetric keys must be kept secret.
Security Protocols/Standards
Security Protocols/Standards Security Protocols/Standards Security Protocols/Standards How do we actually communicate securely across a hostile network? Provide integrity, confidentiality, authenticity
Analyzing DANE's Response to Known DNSsec Vulnerabilities
Analyzing DANE's Response to Known DNSsec Vulnerabilities Matthew Henry Joseph Kirik Emily Scheerer UMBC UMBC UMBC [email protected] [email protected] [email protected] May 9, 2014 Abstract: SSL/TLS is currently
mod_ssl Cryptographic Techniques
mod_ssl Overview Reference The nice thing about standards is that there are so many to choose from. And if you really don t like all the standards you just have to wait another year until the one arises
Understanding Digital Certificates and Wireless Transport Layer Security (WTLS)
Understanding Digital Certificates and Wireless Transport Layer Security (WTLS) Author: Allan Macphee January 2001 Version 1.1 Copyright 2001-2003 Entrust. All rights reserved. Digital Certificates What
Introduction to Network Security Key Management and Distribution
Introduction to Network Security Key Management and Distribution Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of Science and Technology [email protected] http://web.mst.edu/~cetinkayae/teaching/cpe5420fall2015
TLS/SSL in distributed systems. Eugen Babinciuc
TLS/SSL in distributed systems Eugen Babinciuc Contents 1. Introduction to TLS/SSL 2. A quick review of cryptography 3. TLS/SSL in distributed systems 4. Conclusions Introduction to TLS/SSL TLS/SSL History
Managing SSL certificates in the ServerView Suite
Overview - English FUJITSU Software ServerView Suite Managing SSL certificates in the ServerView Suite Secure server management using SSL and PKI Edition September 2015 Comments Suggestions Corrections
[SMO-SFO-ICO-PE-046-GU-
Presentation This module contains all the SSL definitions. See also the SSL Security Guidance Introduction The package SSL is a static library which implements an API to use the dynamic SSL library. It
Managing and Securing Computer Networks. Guy Leduc. Chapter 4: Securing TCP. connections. connections. Chapter goals: security in practice:
Managing and Securing Computer Networks Guy Leduc Chapter 4: Securing TCP connections Computer Networking: A Top Down Approach, 6 th edition. Jim Kurose, Keith Ross Addison-Wesley, March 2012. (section
Public Key Infrastructures
Public Key Infrastructures Ralph Holz Network Architectures and Services Technische Universität München November 2014 Ralph Holz: Public Key Infrastructures 1 Part 2: Recent results or: the sorry state
As enterprises conduct more and more
Efficiently handling SSL transactions is one cornerstone of your IT security infrastructure. Do you know how the protocol actually works? Wesley Chou Inside SSL: The Secure Sockets Layer Protocol Inside
How To Understand And Understand The Security Of A Key Infrastructure
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 12 Applying Cryptography Objectives Define digital certificates List the various types of digital certificates and how they are used
SSL: Paved With Good Intentions. Richard Moore [email protected]
SSL: Paved With Good Intentions Richard Moore [email protected] Why do we need SSL? Privacy Online shopping Online banking Identity Protection Data Integrity Early SSL First public version was SSLv2
Brocade Engineering. PKI Tutorial. Jim Kleinsteiber. February 6, 2002. Page 1
PKI Tutorial Jim Kleinsteiber February 6, 2002 Page 1 Outline Public Key Cryptography Refresher Course Public / Private Key Pair Public-Key Is it really yours? Digital Certificate Certificate Authority
Encryption, Data Integrity, Digital Certificates, and SSL. Developed by. Jerry Scott. SSL Primer-1-1
Encryption, Data Integrity, Digital Certificates, and SSL Developed by Jerry Scott 2002 SSL Primer-1-1 Ideas Behind Encryption When information is transmitted across intranets or the Internet, others can
HTTPS is Fast and Hassle-free with CloudFlare
HTTPS is Fast and Hassle-free with CloudFlare 1 888 99 FLARE [email protected] www.cloudflare.com In the past, organizations had to choose between performance and security when encrypting their
Cryptosystems. Bob wants to send a message M to Alice. Symmetric ciphers: Bob and Alice both share a secret key, K.
Cryptosystems Bob wants to send a message M to Alice. Symmetric ciphers: Bob and Alice both share a secret key, K. C= E(M, K), Bob sends C Alice receives C, M=D(C,K) Use the same key to decrypt. Public
Savitribai Phule Pune University
Savitribai Phule Pune University Centre for Information and Network Security Course: Introduction to Cyber Security / Information Security Module : Pre-requisites in Information and Network Security Chapter
Certificates. Noah Zani, Tim Strasser, Andrés Baumeler
Certificates Noah Zani, Tim Strasser, Andrés Baumeler Overview Motivation Introduction Public Key Infrastructure (PKI) Economic Aspects Motivation Need for secure, trusted communication Growing certificate
Secure Socket Layer. Carlo U. Nicola, SGI FHNW With extracts from publications of : William Stallings.
Secure Socket Layer Carlo U. Nicola, SGI FHNW With extracts from publications of : William Stallings. Abstraction: Crypto building blocks NS HS13 2 Abstraction: The secure channel 1., run a key-exchange
Transport Level Security
Transport Level Security Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
SSL Interception Proxies. Jeff Jarmoc Sr. Security Researcher Dell SecureWorks. and Transitive Trust
SSL Interception Proxies Jeff Jarmoc Sr. Security Researcher Dell SecureWorks and Transitive Trust About this talk History & brief overview of SSL/TLS Interception proxies How and Why Risks introduced
Vulnerabilità dei protocolli SSL/TLS
Università degli Studi di Milano Facoltà di Scienze Matematiche, Fisiche e Naturali Dipartimento di Informatica e Comunicazione Vulnerabilità dei protocolli SSL/TLS Andrea Visconti Overview Introduction
Authenticity of Public Keys
SSL/TLS EJ Jung 10/18/10 Authenticity of Public Keys Bob s key? private key Bob public key Problem: How does know that the public key she received is really Bob s public key? Distribution of Public Keys!
2014 IBM Corporation
2014 IBM Corporation This is the 27 th Q&A event prepared by the IBM License Metric Tool Central Team (ICT) Currently we focus on version 9.x of IBM License Metric Tool (ILMT) The content of today s session
Security Goals Services
1 2 Lecture #8 2008 Freedom from danger, risk, etc.; safety. Something that secures or makes safe; protection; defense. Precautions taken to guard against crime, attack, sabotage, espionage, etc. An assurance;
NIST ITL July 2012 CA Compromise
NIST ITL July 2012 CA Compromise Prepared for: Intelligent People [email protected] 1 NIST ITL Bulletin on CA Compromise http://csrc.nist.gov/publications/nistbul/july-2012_itl-bulletin.pdf These
Certificates and network security
Certificates and network security Tuomas Aura CSE-C3400 Information security Aalto University, autumn 2014 Outline X.509 certificates and PKI Network security basics: threats and goals Secure socket layer
Websense Content Gateway HTTPS Configuration
Websense Content Gateway HTTPS Configuration web security data security email security Support Webinars 2010 Websense, Inc. All rights reserved. Webinar Presenter Title: Sr. Tech Support Specialist Cisco
Installation and usage of SSL certificates: Your guide to getting it right
Installation and usage of SSL certificates: Your guide to getting it right So, you ve bought your SSL Certificate(s). Buying your certificate is only the first of many steps involved in securing your website.
Communication Systems SSL
Communication Systems SSL Computer Science Organization I. Data and voice communication in IP networks II. Security issues in networking III. Digital telephony networks and voice over IP 2 Network Security
Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution.
Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution. 1 Opening quote. 2 The topics of cryptographic key management
Chapter 7 Transport-Level Security
Cryptography and Network Security Chapter 7 Transport-Level Security Lectured by Nguyễn Đức Thái Outline Web Security Issues Security Socket Layer (SSL) Transport Layer Security (TLS) HTTPS Secure Shell
TLS and SRTP for Skype Connect. Technical Datasheet
TLS and SRTP for Skype Connect Technical Datasheet Copyright Skype Limited 2011 Introducing TLS and SRTP Protocols help protect enterprise communications Skype Connect now provides Transport Layer Security
HTTPS: Transport-Layer Security (TLS), aka Secure Sockets Layer (SSL)
CSCD27 Computer and Network Security HTTPS: Transport-Layer Security (TLS), aka Secure Sockets Layer (SSL) 11 SSL CSCD27 Computer and Network Security 1 CSCD27F Computer and Network Security 1 TLS (Transport-Layer
Dr. Cunsheng DING HKUST, Hong Kong. Security Protocols. Security Protocols. Cunsheng Ding, HKUST COMP685C
Cunsheng Ding, HKUST Lecture 06: Public-Key Infrastructure Main Topics of this Lecture 1. Digital certificate 2. Certificate authority (CA) 3. Public key infrastructure (PKI) Page 1 Part I: Digital Certificates
Angel Dichev RIG, SAP Labs
Enabling SSL and Client Certificates on the SAP J2EE Engine Angel Dichev RIG, SAP Labs Learning Objectives As a result of this session, you will be able to: Understand the different SAP J2EE Engine SSL
Security Engineering Part III Network Security. Security Protocols (I): SSL/TLS
Security Engineering Part III Network Security Security Protocols (I): SSL/TLS Juan E. Tapiador [email protected] Department of Computer Science, UC3M Security Engineering 4th year BSc in Computer Science,
Security Protocols HTTPS/ DNSSEC TLS. Internet (IPSEC) Network (802.1x) Application (HTTP,DNS) Transport (TCP/UDP) Transport (TCP/UDP) Internet (IP)
Security Protocols Security Protocols Necessary to communicate securely across untrusted network Provide integrity, confidentiality, authenticity of communications Based on previously discussed cryptographic
Outline. Transport Layer Security (TLS) Security Protocols (bmevihim132)
Security Protocols (bmevihim132) Dr. Levente Buttyán associate professor BME Híradástechnikai Tanszék Lab of Cryptography and System Security (CrySyS) [email protected], [email protected] Outline - architecture
Web Security Considerations
CEN 448 Security and Internet Protocols Chapter 17 Web Security Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University [email protected]
Understanding Digital Certificates & Secure Sockets Layer (SSL): A Fundamental Requirement for Internet Transactions
Understanding Digital Certificates & Secure Sockets Layer (SSL): A Fundamental Requirement for Internet Transactions February 2005 All rights reserved. Page i Entrust is a registered trademark of Entrust,
Network Security (2) CPSC 441 Department of Computer Science University of Calgary
Network Security (2) CPSC 441 Department of Computer Science University of Calgary 1 Friends and enemies: Alice, Bob, Trudy well-known in network security world Bob, Alice (lovers!) want to communicate
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ MEng. Nguyễn CaoĐạt
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ MEng. Nguyễn CaoĐạt 1 Lecture 11: Network Security Reference: Chapter 8 - Computer Networks, Andrew S. Tanenbaum, 4th Edition, Prentice
SSL GOOD PRACTICE GUIDE
SSL GOOD PRACTICE GUIDE VERSION: 1.2 DATE: 10/04/2014 TASK NUMBER: SSL_Whitepaper PREPARED FOR Paul Docherty Director Portcullis Computer Security Ltd The Grange Barn Pike s End Pinner Middlesex HA5 2EX
Enabling SSL and Client Certificates on the SAP J2EE Engine
Enabling SSL and Client Certificates on the SAP J2EE Engine Angel Dichev RIG, SAP Labs SAP AG 1 Learning Objectives As a result of this session, you will be able to: Understand the different SAP J2EE Engine
SSL Protect your users, start with yourself
SSL Protect your users, start with yourself Kulsysmn 14 december 2006 Philip Brusten Overview Introduction Cryptographic algorithms Secure Socket Layer Certificate signing service
Network Security. Computer Networking Lecture 08. March 19, 2012. HKU SPACE Community College. HKU SPACE CC CN Lecture 08 1/23
Network Security Computer Networking Lecture 08 HKU SPACE Community College March 19, 2012 HKU SPACE CC CN Lecture 08 1/23 Outline Introduction Cryptography Algorithms Secret Key Algorithm Message Digest
Three attacks in SSL protocol and their solutions
Three attacks in SSL protocol and their solutions Hong lei Zhang Department of Computer Science The University of Auckland [email protected] Abstract Secure Socket Layer (SSL) and Transport Layer
Key Management (Distribution and Certification) (1)
Key Management (Distribution and Certification) (1) Remaining problem of the public key approach: How to ensure that the public key received is really the one of the sender? Illustration of the problem
The Secure Sockets Layer (SSL)
Due to the fact that nearly all businesses have websites (as well as government agencies and individuals) a large enthusiasm exists for setting up facilities on the Web for electronic commerce. Of course
Lab Exercise SSL/TLS. Objective. Step 1: Open a Trace. Step 2: Inspect the Trace
Lab Exercise SSL/TLS Objective To observe SSL/TLS (Secure Sockets Layer / Transport Layer Security) in action. SSL/TLS is used to secure TCP connections, and it is widely used as part of the secure web:
Real-Time Communication Security: SSL/TLS. Guevara Noubir [email protected] CSU610
Real-Time Communication Security: SSL/TLS Guevara Noubir [email protected] CSU610 1 Some Issues with Real-time Communication Session key establishment Perfect Forward Secrecy Diffie-Hellman based PFS
SSL Handshake Analysis
SSL Handshake Analysis Computer Measurement Group Webinar Nalini Elkins Inside Products, Inc. [email protected] Inside Products, Inc. (831) 659-8360 www.insidethestack.com www.ipproblemfinders.com
Securing VMware View Communication Channels with SSL Certificates TECHNICAL WHITE PAPER
Securing VMware View Communication Channels with SSL Certificates TECHNICAL WHITE PAPER Table of Contents About VMware View.... 3 Changes in VMware View 5.1.... 3 SSL Authentication Mechanism.... 4 X.509
CS 392/681 - Computer Security
CS 392/681 - Computer Security Module 3 Key Exchange Algorithms Nasir Memon Polytechnic University Course Issues HW 3 assigned. Any lab or course issues? Midterm in three weeks. 8/30/04 Module 3 - Key
Certificate Management. PAN-OS Administrator s Guide. Version 7.0
Certificate Management PAN-OS Administrator s Guide Version 7.0 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact-us
Understanding digital certificates
Understanding digital certificates Mick O Brien and George R S Weir Department of Computer and Information Sciences, University of Strathclyde Glasgow G1 1XH [email protected], [email protected]
Cryptography and Network Security Chapter 14
Cryptography and Network Security Chapter 14 Fifth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 14 Key Management and Distribution No Singhalese, whether man or woman, would venture
Software Engineering 4C03 Research Project. An Overview of Secure Transmission on the World Wide Web. Sean MacDonald 0043306
Software Engineering 4C03 Research Project An Overview of Secure Transmission on the World Wide Web Sean MacDonald 0043306 Tuesday April 5, 2005 Introduction Software Engineering 4C03 Research Project