Systematization of Knowledge Lessons Learned From SSL/TLS Attacks
|
|
|
- Gladys Craig
- 10 years ago
- Views:
Transcription
1 Systematization of Knowledge Lessons Learned From SSL/TLS Attacks Source:
2 Source:
3 Source:
4 What if we don't even need the private key? 4
5 Nearly 20 years of SSL/TLS 5
6 Nearly 20 years of SSL/TLS Some key data Invented in
7 Nearly 20 years of SSL/TLS Some key data Invented in 1994 Evolutionary development 7
8 Nearly 20 years of SSL/TLS Some key data Invented in 1994 Evolutionary development 5 official and 1 unpublished revision SSL 2.0, SSL 3.0 TLS 1.0, TLS 1.1, TLS 1.2 SSL 1.0 8
9 Nearly 20 years of SSL/TLS Some key data Invented in 1994 Evolutionary development 5 official and 1 unpublished revision SSL 2.0, SSL 3.0 TLS 1.0, TLS 1.1, TLS 1.2 SSL 1.0 ~ 39 theoretical and practical attacks so far 9
10 Timeline 10
11 Contribution 11
12 Contribution Collected attacks on SSL/TLS 12
13 Contribution Collected attacks on SSL/TLS Analyzed all attacks 13
14 Contribution Collected attacks on SSL/TLS Analyzed all attacks Categorized each attack 14
15 Contribution Collected attacks on SSL/TLS Analyzed all attacks Categorized each attack Identified the root cause of the vulnerabilities for each attack 15
16 Contribution Collected attacks on SSL/TLS Analyzed all attacks Categorized each attack Identified the root cause of the vulnerabilities for each attack Concluded Lessons Learned for each attack 16
17 Contribution Collected attacks on SSL/TLS Analyzed all attacks Categorized each attack Identified the root cause of the vulnerabilities for each attack Concluded Lessons Learned for each attack Created a Guideline for Protocol Designers and Implementers 17
18 Attack Patterns Abnormalities during the analysis of attacks 18
19 Attack Patterns Abnormalities during the analysis of attacks Attacks focus on specific parts/layers of SSL/TLS 19
20 Attack Patterns Abnormalities during the analysis of attacks Attacks focus on specific parts/layers of SSL/TLS Attacks can be grouped into 4 categories 20
21 Attack Patterns Abnormalities during the analysis of attacks Attacks focus on specific parts/layers of SSL/TLS Attacks can be grouped into 4 categories 1. Attacks on the Handshake Protocol 21
22 Attack Patterns Abnormalities during the analysis of attacks Attacks focus on specific parts/layers of SSL/TLS Attacks can be grouped into 4 categories 1. Attacks on the Handshake Protocol 2. Attacks on the Record Layer 22
23 Attack Patterns Abnormalities during the analysis of attacks Attacks focus on specific parts/layers of SSL/TLS Attacks can be grouped into 4 categories 1. Attacks on the Handshake Protocol 2. Attacks on the Record Layer 3. Attacks on the PKI 23
24 Attack Patterns Abnormalities during the analysis of attacks Attacks focus on specific parts/layers of SSL/TLS Attacks can be grouped into 4 categories 1. Attacks on the Handshake Protocol 2. Attacks on the Record Layer 3. Attacks on the PKI 4. Various other Attacks 24
25 Attacks on the Handshake Protocol Details Main goal: Influence Handshake Phase 25
26 Attacks on the Handshake Protocol Details Main goal: Influence Handshake Phase A R I S E 26
27 Attacks on the Handshake Protocol Details Main goal: Influence Handshake Phase Alter messages or message parts R I S E 27
28 Attacks on the Handshake Protocol Details Main goal: Influence Handshake Phase Alter messages or message parts Replay communication or parts of it I S E 28
29 Attacks on the Handshake Protocol Details Main goal: Influence Handshake Phase Alter messages or message parts Replay communication or parts of it Interfere messages or message parts S E 29
30 Attacks on the Handshake Protocol Details Main goal: Influence Handshake Phase Alter messages or message parts Replay communication or parts of it Interfere messages or message parts Systematically analyze communication E 30
31 Attacks on the Handshake Protocol Details Main goal: Influence Handshake Phase Alter messages or message parts Replay communication or parts of it Interfere messages or message parts Systematically analyze communication Establish own Cryptographic Primitives 31
32 Attacks on the Handshake Protocol Details 32
33 Attacks on the Record Layer Details Main goal: Violate Confidentiality or Integrity 33
34 Attacks on the Record Layer Details Main goal: Violate Confidentiality or Integrity B A T 34
35 Attacks on the Record Layer Details Main goal: Violate Confidentiality or Integrity Break Encryption A T 35
36 Attacks on the Record Layer Details Main goal: Violate Confidentiality or Integrity Break Encryption Analyze Encrypted Traffic T 36
37 Attacks on the Record Layer Details Main goal: Violate Confidentiality or Integrity Break Encryption Analyze Encrypted Traffic Tamper with MAC 37
38 Attacks on the Record Layer Details 38
39 Attacks on the PKI Details Main goal: Influence, Compromise or Trick PKI 39
40 Attacks on the PKI Details Main goal: Influence, Compromise or Trick PKI R I T C H 40
41 Attacks on the PKI Details Main goal: Influence, Compromise or Trick PKI Recover or Break Private Keys I T C H 41
42 Attacks on the PKI Details Main goal: Influence, Compromise or Trick PKI Recover or Break Private Keys Influence Certificate Revocation Systems T C H 42
43 Attacks on the PKI Details Main goal: Influence, Compromise or Trick PKI Recover or Break Private Keys Influence Certificate Revocation Systems Trick Certificate Validation C H 43
44 Attacks on the PKI Details Main goal: Influence, Compromise or Trick PKI Recover or Break Private Keys Influence Certificate Revocation Systems Trick Certificate Validation Compute Colliding Certificates H 44
45 Attacks on the PKI Details Main goal: Influence, Compromise or Trick PKI Recover or Break Private Keys Influence Certificate Revocation Systems Trick Certificate Validation Compute Colliding Certificates Hack or Trick Certification Authorities 45
46 Attacks on the PKI Details 46
47 Various Other Attacks Details Main goal: Predict, Disturb, Inject, Disable 47
48 Various Other Attacks Details Main goal: Predict, Disturb, Inject, Disable G A S P 48
49 Various Other Attacks Details Main goal: Predict, Disturb, Inject, Disable Guess Random Numbers A S P 49
50 Various Other Attacks Details Main goal: Predict, Disturb, Inject, Disable Guess Random Numbers Affect Reliability S P 50
51 Various Other Attacks Details Main goal: Predict, Disturb, Inject, Disable Guess Random Numbers Affect Reliability Smuggle Data into Running Connections P 51
52 Various Other Attacks Details Main goal: Predict, Disturb, Inject, Disable Guess Random Numbers Affect Reliability Smuggle Data into Running Connections Prevent Traffic Encryption (disable SSL/TLS) 52
53 Various Other Attacks Details 53
54 Finally... I tried to put the keywords in a meaningful context 54
55 Finally... I tried to put the keywords in a meaningful context e t a n u t r o f n u u s t u o h it w ly s s e cc 55
56 Lessons Learned 1/2 what can we conclude? 56
57 Lessons Learned 1/2 what can we conclude? 1. Theoretical attacks can turn into practice 57
58 Lessons Learned 1/2 what can we conclude? Theoretical attacks can turn into practice Side channels may appear at different layers in different situations 58
59 Lessons Learned 1/2 what can we conclude? Theoretical attacks can turn into practice Side channels may appear at different layers in different situations Reliable cryptographic primitives are important 59
60 Lessons Learned 1/2 what can we conclude? Theoretical attacks can turn into practice Side channels may appear at different layers in different situations Reliable cryptographic primitives are important Processes must leak as little information as possible 60
61 Lessons Learned 1/2 what can we conclude? Theoretical attacks can turn into practice Side channels may appear at different layers in different situations Reliable cryptographic primitives are important Processes must leak as little information as possible Specifications have to be implemented without own improvements 61
62 Lessons Learned 1/2 what can we conclude? Theoretical attacks can turn into practice Side channels may appear at different layers in different situations Reliable cryptographic primitives are important Processes must leak as little information as possible Specifications have to be implemented without own improvements Critical parts in specifications and source code have to be highlighted 62
63 Lessons Learned 2/2 what can we conclude? 7. Specifications have to verbose, unambiguous and technically detailed 63
64 Lessons Learned 2/2 what can we conclude? Specifications have to verbose, unambiguous and technically detailed Details on requirements and preconditions are necessary 64
65 Lessons Learned 2/2 what can we conclude? Specifications have to verbose, unambiguous and technically detailed Details on requirements and preconditions are necessary Data has to be protected 65
66 Lessons Learned 2/2 what can we conclude? Specifications have to verbose, unambiguous and technically detailed Details on requirements and preconditions are necessary Data has to be protected The interplay between different layers must be part of the security analysis 66
67 Lessons Learned 2/2 what can we conclude? Specifications have to verbose, unambiguous and technically detailed Details on requirements and preconditions are necessary Data has to be protected The interplay between different layers must be part of the security analysis Flexibility mostly means additional risks 67
68 Lessons Learned 2/2 what can we conclude? Specifications have to verbose, unambiguous and technically detailed Details on requirements and preconditions are necessary Data has to be protected The interplay between different layers must be part of the security analysis Flexibility mostly means additional risks Always be careful and alarmed 68
69 Source: Chris Meyer 69
Vulnerabilità dei protocolli SSL/TLS
Università degli Studi di Milano Facoltà di Scienze Matematiche, Fisiche e Naturali Dipartimento di Informatica e Comunicazione Vulnerabilità dei protocolli SSL/TLS Andrea Visconti Overview Introduction
Using etoken for SSL Web Authentication. SSL V3.0 Overview
Using etoken for SSL Web Authentication Lesson 12 April 2004 etoken Certification Course SSL V3.0 Overview Secure Sockets Layer protocol, version 3.0 Provides communication privacy over the internet. Prevents
Using BroadSAFE TM Technology 07/18/05
Using BroadSAFE TM Technology 07/18/05 Layers of a Security System Security System Data Encryption Key Negotiation Authentication Identity Root Key Once root is compromised, all subsequent layers of security
Secure Socket Layer/ Transport Layer Security (SSL/TLS)
Secure Socket Layer/ Transport Layer Security (SSL/TLS) David Sánchez Universitat Pompeu Fabra World Wide Web (www) Client/server services running over the Internet or TCP/IP Intranets nets widely used
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI) In this video you will learn the quite a bit about Public Key Infrastructure and how it is used to authenticate clients and servers. The purpose of Public Key Infrastructure
Understanding Digital Certificates and Secure Sockets Layer (SSL)
Understanding Digital Certificates and Secure Sockets Layer (SSL) Author: Peter Robinson January 2001 Version 1.1 Copyright 2001-2003 Entrust. All rights reserved. Digital Certificates What are they?
Security Goals Services
1 2 Lecture #8 2008 Freedom from danger, risk, etc.; safety. Something that secures or makes safe; protection; defense. Precautions taken to guard against crime, attack, sabotage, espionage, etc. An assurance;
Cryptography and Network Security
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Shinu Mathew John http://shinu.info/ Chapter 1 Introduction http://shinu.info/ 2 Background Information Security requirements
INF3510 Information Security University of Oslo Spring 2011. Lecture 9 Communication Security. Audun Jøsang
INF3510 Information Security University of Oslo Spring 2011 Lecture 9 Communication Security Audun Jøsang Outline Network security concepts Communication security Perimeter security Protocol architecture
Chap. 1: Introduction
Chap. 1: Introduction Introduction Services, Mechanisms, and Attacks The OSI Security Architecture Cryptography 1 1 Introduction Computer Security the generic name for the collection of tools designed
Security Protocols HTTPS/ DNSSEC TLS. Internet (IPSEC) Network (802.1x) Application (HTTP,DNS) Transport (TCP/UDP) Transport (TCP/UDP) Internet (IP)
Security Protocols Security Protocols Necessary to communicate securely across untrusted network Provide integrity, confidentiality, authenticity of communications Based on previously discussed cryptographic
3.2: Transport Layer: SSL/TLS Secure Socket Layer (SSL) Transport Layer Security (TLS) Protocol
Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Network Layer: IPSec Transport Layer: SSL/TLS Chapter 4: Security on the Application Layer Chapter 5: Security
544 Computer and Network Security
544 Computer and Network Security Section 1: Introduction Dr. E.C. Kulasekere Sri Lanka Institute of Information Technology - 2005 Background Information Security requirements have changed in recent times
Chapter 7 Transport-Level Security
Cryptography and Network Security Chapter 7 Transport-Level Security Lectured by Nguyễn Đức Thái Outline Web Security Issues Security Socket Layer (SSL) Transport Layer Security (TLS) HTTPS Secure Shell
Advanced Topics in Distributed Systems. Dr. Ayman Abdel-Hamid Computer Science Department Virginia Tech
Advanced Topics in Distributed Systems Dr. Ayman Abdel-Hamid Computer Science Department Virginia Tech Security Introduction Based on Ch1, Cryptography and Network Security 4 th Ed Security Dr. Ayman Abdel-Hamid,
Certificate Authorities and Public Keys. How they work and 10+ ways to hack them.
Certificate Authorities and Public Keys How they work and 10+ ways to hack them. -- FoxGuard Solutions Www.FoxGuardSolutions.com [email protected] Version.05 9/2012 1 Certificate Use Overview
CUNSHENG DING HKUST, Hong Kong. Computer Security. Computer Security. Cunsheng DING, HKUST COMP4631
Cunsheng DING, HKUST Lecture 08: Key Management for One-key Ciphers Topics of this Lecture 1. The generation and distribution of secret keys. 2. A key distribution protocol with a key distribution center.
Information System Security
Information System Security Chapter 1:Introduction Dr. Lo ai Tawalbeh Faculty of Information system and Technology, The Arab Academy for Banking and Financial Sciences. Jordan Chapter 1 Introduction The
Virtual Private Networks
Virtual Private Networks ECE 4886 Internetwork Security Dr. Henry Owen Definition Virtual Private Network VPN! Virtual separation in protocol provides a virtual network using no new hardware! Private communication
How To Understand And Understand The Security Of A Key Infrastructure
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 12 Applying Cryptography Objectives Define digital certificates List the various types of digital certificates and how they are used
Lab Exercise SSL/TLS. Objective. Step 1: Open a Trace. Step 2: Inspect the Trace
Lab Exercise SSL/TLS Objective To observe SSL/TLS (Secure Sockets Layer / Transport Layer Security) in action. SSL/TLS is used to secure TCP connections, and it is widely used as part of the secure web:
Security. Contents. S-72.3240 Wireless Personal, Local, Metropolitan, and Wide Area Networks 1
Contents Security requirements Public key cryptography Key agreement/transport schemes Man-in-the-middle attack vulnerability Encryption. digital signature, hash, certification Complete security solutions
CPS 590.5 Computer Security Lecture 9: Introduction to Network Security. Xiaowei Yang [email protected]
CPS 590.5 Computer Security Lecture 9: Introduction to Network Security Xiaowei Yang [email protected] Previous lectures Worm Fast worm design Today Network security Cryptography building blocks Existing
Overview. SSL Cryptography Overview CHAPTER 1
CHAPTER 1 Note The information in this chapter applies to both the ACE module and the ACE appliance unless otherwise noted. The features in this chapter apply to IPv4 and IPv6 unless otherwise noted. Secure
TELNET CLIENT 5.0 SSL/TLS SUPPORT
TELNET CLIENT 5.0 SSL/TLS SUPPORT This document provides information on the SSL/ TLS support available in Telnet Client 5.0 This document describes how to install and configure SSL/TLS support and verification
Spirent Abacus. SIP over TLS Test 编 号 版 本 修 改 时 间 说 明
Spirent Abacus SIP over TLS Test 编 号 版 本 修 改 时 间 说 明 1 1. TLS Interview (Transport Layer Security Protocol) (1) TLS Feature Introduction: 1. TLS is a successor of Secure Sockets Layer (SSL), a cryptographic
Overview SSL/TLS HTTPS SSH. TLS Protocol Architecture TLS Handshake Protocol TLS Record Protocol. SSH Protocol Architecture SSH Transport Protocol
SSL/TLS TLS Protocol Architecture TLS Handshake Protocol TLS Record Protocol HTTPS SSH SSH Protocol Architecture SSH Transport Protocol Overview SSH User Authentication Protocol SSH Connection Protocol
Cryptography and Network Security Chapter 1
Cryptography and Network Security Chapter 1 Acknowledgments Lecture slides are based on the slides created by Lawrie Brown Chapter 1 Introduction The art of war teaches us to rely not on the likelihood
Advance Technique for Online Payment Security in E-Commerce : Double Verification
Advance Technique for Online Payment Security in E-Commerce : Double Verification Shilpa Research Scholar Shri Krishan Institute of Engineering & Technology, Kurukshetra University Kurukshetra, India [email protected]
VIDEO Intypedia012en LESSON 12: WI FI NETWORKS SECURITY. AUTHOR: Raúl Siles. Founder and Security Analyst at Taddong
VIDEO Intypedia012en LESSON 12: WI FI NETWORKS SECURITY AUTHOR: Raúl Siles Founder and Security Analyst at Taddong Hello and welcome to Intypedia. Today we will talk about the exciting world of security
SSL implementieren aber sicher!
SSL implementieren aber sicher! Karlsruher Entwicklertag 2014 21.05.2014 Dr. Yun Ding SSL in the news 2011 2012 2013 2014 BEAST CRIME Lucky 13 Compromised CAs RC4 biases BREACH DRBG Backdoor Apple goto
Web Application Entity Session Management using the eid Card Frank Cornelis 03/03/2010. Fedict 2010. All rights reserved
Web Application Entity Session Management using the eid Card Frank Cornelis 03/03/2010 Fedict 2010. All rights reserved What is Entity Authentication? Entity authentication is the process whereby one party
Overview of CSS SSL. SSL Cryptography Overview CHAPTER
CHAPTER 1 Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet, ensuring secure transactions such as the transmission of credit card numbers
Web Security Considerations
CEN 448 Security and Internet Protocols Chapter 17 Web Security Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University [email protected]
HTTPS: Transport-Layer Security (TLS), aka Secure Sockets Layer (SSL)
CSCD27 Computer and Network Security HTTPS: Transport-Layer Security (TLS), aka Secure Sockets Layer (SSL) 11 SSL CSCD27 Computer and Network Security 1 CSCD27F Computer and Network Security 1 TLS (Transport-Layer
Transport Layer Security Protocols
SSL/TLS 1 Transport Layer Security Protocols Secure Socket Layer (SSL) Originally designed to by Netscape to secure HTTP Version 2 is being replaced by version 3 Subsequently became Internet Standard known
Security Engineering Part III Network Security. Security Protocols (I): SSL/TLS
Security Engineering Part III Network Security Security Protocols (I): SSL/TLS Juan E. Tapiador [email protected] Department of Computer Science, UC3M Security Engineering 4th year BSc in Computer Science,
Programming Flaws and How to Fix Them
19 ö Programming Flaws and How to Fix Them MICHAEL HOWARD DAVID LEBLANC JOHN VIEGA McGraw-Hill /Osborne New York Chicago San Francisco Lisbon London Madrid Mexico City- Milan New Delhi San Juan Seoul Singapore
Last update: February 23, 2004
Last update: February 23, 2004 Web Security Glossary The Web Security Glossary is an alphabetical index of terms and terminology relating to web application security. The purpose of the Glossary is to
7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?
7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk
Web Payment Security. A discussion of methods providing secure communication on the Internet. Zhao Huang Shahid Kahn
Web Payment Security A discussion of methods providing secure communication on the Internet Group Members: Peter Heighton Zhao Huang Shahid Kahn 1. Introduction Within this report the methods taken to
Security Protocols/Standards
Security Protocols/Standards Security Protocols/Standards Security Protocols/Standards How do we actually communicate securely across a hostile network? Provide integrity, confidentiality, authenticity
Secure Socket Layer. Introduction Overview of SSL What SSL is Useful For
Secure Socket Layer Secure Socket Layer Introduction Overview of SSL What SSL is Useful For Introduction Secure Socket Layer (SSL) Industry-standard method for protecting web communications. - Data encryption
TLS and SRTP for Skype Connect. Technical Datasheet
TLS and SRTP for Skype Connect Technical Datasheet Copyright Skype Limited 2011 Introducing TLS and SRTP Protocols help protect enterprise communications Skype Connect now provides Transport Layer Security
Authenticity of Public Keys
SSL/TLS EJ Jung 10/18/10 Authenticity of Public Keys Bob s key? private key Bob public key Problem: How does know that the public key she received is really Bob s public key? Distribution of Public Keys!
Secure Socket Layer (SSL) and Trnasport Layer Security (TLS)
Secure Socket Layer (SSL) and Trnasport Layer Security (TLS) CSE598K/CSE545 - Advanced Network Security Prof. McDaniel - Spring 2008 1 SSL/TLS The Secure Socket Layer (SSL) and Transport Layer Security
Security in the PEPPOL
Security in the PEPPOL infrastructure Presentation for OASIS BUSDOX TC, March 2011 Thomas Gundel, IT Crew Agenda PART I Security goals in PEPPOL Scope and requirements Security overview PART II Trust models
INTERNET SECURITY: FIREWALLS AND BEYOND. Mehernosh H. Amroli 4-25-2002
INTERNET SECURITY: FIREWALLS AND BEYOND Mehernosh H. Amroli 4-25-2002 Preview History of Internet Firewall Technology Internet Layer Security Transport Layer Security Application Layer Security Before
Chapter 17. Transport-Level Security
Chapter 17 Transport-Level Security Web Security Considerations The World Wide Web is fundamentally a client/server application running over the Internet and TCP/IP intranets The following characteristics
Introduction to Cryptography
Introduction to Cryptography Part 3: real world applications Jean-Sébastien Coron January 2007 Public-key encryption BOB ALICE Insecure M E C C D channel M Alice s public-key Alice s private-key Authentication
Network Security Essentials Chapter 5
Network Security Essentials Chapter 5 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 5 Transport-Level Security Use your mentality Wake up to reality From the song, "I've Got
SSL/TLS: The Ugly Truth
SSL/TLS: The Ugly Truth Examining the flaws in SSL/TLS protocols, and the use of certificate authorities. Adrian Hayter CNS Hut 3 Team [email protected] Contents Introduction to SSL/TLS Cryptography
Contents. Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008
Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008 Contents Authentication and Identity Assurance The Identity Assurance continuum Plain Password Authentication
IBX Business Network Platform Information Security Controls. 2015-02- 20 Document Classification [Public]
![IBX Business Network Platform Information Security Controls. 2015-02- 20 Document Classification [Public]](/thumbs/26/7758795.jpg "IBX Business Network Platform Information Security Controls. 2015-02- 20 Document Classification [Public]")
IBX Business Network Platform Information Security Controls 2015-02- 20 Document Classification [Public] Table of Contents 1. General 2 2. Physical Security 2 3. Network Access Control 2 4. Operating System
Outline. INF3510 Information Security. Lecture 10: Communications Security. Communication Security Analogy. Network Security Concepts
Outline INF3510 Information Security Lecture 10: Communications Security Network security concepts Communication security Perimeter security Protocol architecture and security services Example security
Understanding Digital Certificates and Wireless Transport Layer Security (WTLS)
Understanding Digital Certificates and Wireless Transport Layer Security (WTLS) Author: Allan Macphee January 2001 Version 1.1 Copyright 2001-2003 Entrust. All rights reserved. Digital Certificates What
Introduction. Haroula Zouridaki Mohammed Bin Abdullah Waheed Qureshi
Introduction Haroula Zouridaki Mohammed Bin Abdullah Waheed Qureshi Introduction Comparing Secure Hypertext protocol (S-HTTP) to Secure Socket Layer (SSL) Agenda Waheed opens the presentation introduces
Lecture 10: Communications Security
INF3510 Information Security Lecture 10: Communications Security Audun Jøsang University of Oslo Spring 2015 Outline Network security concepts Communication security Perimeter security Protocol architecture
Using EMV Cards to Protect E-commerce Transactions
Using EMV Cards to Protect E-commerce Transactions Vorapranee Khu-Smith and Chris J. Mitchell Information Security Group, Royal Holloway, University of London, Egham, Surrey, TW20 0EX, United Kingdom {V.Khu-Smith,
Security + Certification (ITSY 1076) Syllabus
Security + Certification (ITSY 1076) Syllabus Course: ITSY 1076 Security+ 40 hours Course Description: This course is targeted toward an Information Technology (IT) professional who has networking and
TinySec: A Link Layer Security Architecture for Wireless Sensor Networks
TinySec: A Link Layer Security Architecture for Wireless Sensor Networks Chris Karlof, Naveen Sastr, David Wagner Presented By: Tristan Brown Outline Motivation Cryptography Overview TinySec Design Implementation
DNS security: poisoning, attacks and mitigation
DNS security: poisoning, attacks and mitigation The Domain Name Service underpins our use of the Internet, but it has been proven to be flawed and open to attack. Richard Agar and Kenneth Paterson explain
End-to-End Security in Wireless Sensor Networks (WSNs) Talk by Claudio Anliker Supervised by Dr. Corinna Schmitt CSG@IFI, University of Zurich
End-to-End Security in Wireless Sensor (WSNs) Talk by Supervised by Dr. Corinna Schmitt CSG@IFI, University of Zurich Content 1. Motivation 2. Security Issues and Principles 3. Internet-of-Things and Wireless
Cipher Suite Rollback: A Misuse Pattern for the SSL/TLS Client/Server Authentication Handshake Protocol
Cipher Suite Rollback: A Misuse Pattern for the SSL/TLS Client/Server Authentication Handshake Protocol ALI ALKAZIMI, Florida Atlantic University EDUARDO B. FERNANDEZ, Florida Atlantic University Transport
Introduction to Computer Security
Introduction to Computer Security Network Security Pavel Laskov Wilhelm Schickard Institute for Computer Science Circuit switching vs. packet switching OSI and TCP/IP layered models TCP/IP encapsulation
TLS/SSL in distributed systems. Eugen Babinciuc
TLS/SSL in distributed systems Eugen Babinciuc Contents 1. Introduction to TLS/SSL 2. A quick review of cryptography 3. TLS/SSL in distributed systems 4. Conclusions Introduction to TLS/SSL TLS/SSL History
Lesson 10: Attacks to the SSL Protocol
Lesson 10: Attacks to the SSL Protocol Luciano Bello - [email protected] Chalmers University Dr. Alfonso Muñoz - [email protected] T>SIC Group. Universidad Politécnica de Madrid Security of the SSL
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 1 January 9, 2012 CPSC 467b, Lecture 1 1/22 Course Overview Symmetric Cryptography CPSC 467b, Lecture 1 2/22 Course Overview CPSC
7. Public Key Cryptosystems and Digital Signatures, 8. Firewalls, 9. Intrusion detection systems, 10. Biometric Security Systems, 11.
Content 1.Introduction to Data and Network Security. 2. Why secure your Network 3. How Much security do you need, 4. Communication of network systems, 5. Topology security, 6. Cryptosystems and Symmetric
INFORMATION SUPPLEMENT. Migrating from SSL and Early TLS. Version 1.0 Date: April 2015 Author: PCI Security Standards Council
Version 1.0 Date: Author: PCI Security Standards Council Executive Summary The time to migrate is now. For over 20 years Secure Sockets Layer (SSL) has been in the market as one of the most widely-used
More on SHA-1 deprecation:
Dear PTC Axeda Customer, This message specifies Axeda and IDM Agent upgrade requirements and timelines for transitioning Axeda Enterprise Server, Global Access Server (GAS), Policy Server, and Questra
Introduction to Network Security Key Management and Distribution
Introduction to Network Security Key Management and Distribution Egemen K. Çetinkaya Department of Electrical & Computer Engineering Missouri University of Science and Technology [email protected] http://web.mst.edu/~cetinkayae/teaching/cpe5420fall2015
Citrix MetaFrame XP Security Standards and Deployment Scenarios
Citrix MetaFrame XP Security Standards and Deployment Scenarios Including Common Criteria Information MetaFrame XP Server for Windows with Feature Release 3 Citrix Systems, Inc. Information in this document
Implementation Vulnerabilities in SSL/TLS
Implementation Vulnerabilities in SSL/TLS Marián Novotný [email protected] ESET, spol. s r.o. Bratislava, Slovak Republic Abstract SSL/TLS protocol has become a standard way for establishing a secure communication
Lecture 7: Transport Level Security SSL/TLS. Course Admin
Lecture 7: Transport Level Security SSL/TLS CS 336/536: Computer Network Security Fall 2014 Nitesh Saxena Adopted from previous lecture by Tony Barnard Course Admin HW/Lab 1 Graded; scores posted; to be
Lab Exercise SSL/TLS. Objective. Requirements. Step 1: Capture a Trace
Lab Exercise SSL/TLS Objective To observe SSL/TLS (Secure Sockets Layer / Transport Layer Security) in action. SSL/TLS is used to secure TCP connections, and it is widely used as part of the secure web:
SSL A discussion of the Secure Socket Layer
www.harmonysecurity.com [email protected] SSL A discussion of the Secure Socket Layer By Stephen Fewer Contents 1 Introduction 2 2 Encryption Techniques 3 3 Protocol Overview 3 3.1 The SSL Record
Plain English Guide To Common Criteria Requirements In The. Field Device Protection Profile Version 0.75
Plain English Guide To Common Criteria Requirements In The Field Device Protection Profile Version 0.75 Prepared For: Process Control Security Requirements Forum (PCSRF) Prepared By: Digital Bond, Inc.
PCI Security Standards Council
PCI Security Standards Council Ralph Poore, Director, Emerging Standards 2013 About PCI Emerging Technologies OWASP and Mobile Guidelines About PCI About the PCI Council Open, global forum Founded 2006
SSL: Secure Socket Layer
SSL: Secure Socket Layer Steven M. Bellovin February 12, 2009 1 Choices in Key Exchange We have two basic ways to do key exchange, public key (with PKI or pki) or KDC Which is better? What are the properties
Secure Sockets Layer (SSL) / Transport Layer Security (TLS)
Secure Sockets Layer (SSL) / Transport Layer Security (TLS) Brad Karp UCL Computer Science CS GZ03 / M030 19 th November 2014 What Problems Do SSL/TLS Solve? Two parties, client and server, not previously
IPv4 Shortage Multiple SSL Certificates on a single IP address
GlobalSign. A GMO Internet Inc group company. IPv4 Shortage Multiple SSL Certificates on a single IP address Paul van Brouwershaven EMEA Business Development Director GLOBALSIGN SOLUTIONS Visible Trust
Authentication and Security in IP based Multi Hop Networks
7TH WWRF MEETING IN EINDHOVEN, THE NETHERLANDS 3RD - 4TH DECEMBER 2002 1 Authentication and Security in IP based Multi Hop Networks Frank Fitzek, Andreas Köpsel, Patrick Seeling Abstract Network security
Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution.
Lecture slides by Lawrie Brown for Cryptography and Network Security, 5/e, by William Stallings, Chapter 14 Key Management and Distribution. 1 Opening quote. 2 The topics of cryptographic key management
Server-Assisted Generation of a Strong Secret from a Password
Server-Assisted Generation of a Strong Secret from a Password Warwick Ford, VeriSign, Inc. (Joint research with Burt Kaliski, RSA Laboratories) Requirement! User who roams between client terminals needs
Chapter 10. Network Security
Chapter 10 Network Security 10.1. Chapter 10: Outline 10.1 INTRODUCTION 10.2 CONFIDENTIALITY 10.3 OTHER ASPECTS OF SECURITY 10.4 INTERNET SECURITY 10.5 FIREWALLS 10.2 Chapter 10: Objective We introduce
Low-Level TLS Hacking
Low-Level TLS Hacking Presented by Richard J. Moore E: [email protected] Presentation Outline An introduction to SSL/TLS Using pytls to create and decode TLS messages Fingerprinting TLS servers Fingerprinting
CSE/EE 461 Lecture 23
CSE/EE 461 Lecture 23 Network Security David Wetherall [email protected] Last Time Naming Application Presentation How do we name hosts etc.? Session Transport Network Domain Name System (DNS) Data
Savitribai Phule Pune University
Savitribai Phule Pune University Centre for Information and Network Security Course: Introduction to Cyber Security / Information Security Module : Pre-requisites in Information and Network Security Chapter
Introduction to Computer Security
Introduction to Computer Security Network Security Pavel Laskov Wilhelm Schickard Institute for Computer Science Circuit switching vs. packet switching OSI and TCP/IP layered models TCP/IP encapsulation
Certificates and network security
Certificates and network security Tuomas Aura CSE-C3400 Information security Aalto University, autumn 2014 Outline X.509 certificates and PKI Network security basics: threats and goals Secure socket layer
Three attacks in SSL protocol and their solutions
Three attacks in SSL protocol and their solutions Hong lei Zhang Department of Computer Science The University of Auckland [email protected] Abstract Secure Socket Layer (SSL) and Transport Layer
The Secure Sockets Layer (SSL)
Due to the fact that nearly all businesses have websites (as well as government agencies and individuals) a large enthusiasm exists for setting up facilities on the Web for electronic commerce. Of course
Introduction to WiFi Security. Frank Sweetser WPI Network Operations and Security [email protected]
Introduction to WiFi Security Frank Sweetser WPI Network Operations and Security [email protected] Why should I care? Or, more formally what are the risks? Unauthorized connections Stealing bandwidth Attacks
Transport Level Security
Transport Level Security Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/