TLS Secures the Web

Transport Layer Security
A story of recovering from failures
Anwar Reddick
September 2018

Sometime between
100 BC and 44 BC

Some dude named Gaius …
DWWDFN!
ATTACK!
DWWDFN?
Huh?
was an early cryptography pioneer
G. Julius
Mr Spy
Mr General

crypt = secret
graphy = to write
cryptography =
The art of secret writing

Caesar’s cipher: A shift cipher
Encryption
A
D
T
W
T
W
A
D
C
F
Decryption
D
A
W
T
W
T
D
A
F
C
shift fwd shift rev
Key Key
3 3
Encryption Decryption

This worked for a little while, but ...
DWWDFN!
ATTACK!
DWWDFN?
Huh?
too
easyG. Julius
Mr Spy
Mr General
Zeke

Crypto done poorly
Mary QoS
1586
Alan T.
U-Boat
1942

Getting better at
crypto
A cipher is “strong” until the smartest
minds in the world can get “close” to
breaking it.
1945
Claude S.
“A Mathematical Theory
of Cryptography”
aka “Starting point of
modern crypto”
All practical ciphers are
“breakable”.
Contains foundations of
mathematical cryptanalysis.
We can obtain mathematical
proofs of certain levels of
cryptographic security.

First message on the ARPANET
1969
Charley K.
“L”“O”
CRASH!

First message on the ARPANET
1969
Charley K.
“L” “O” Crash!

Inter-networking
1983
Vint C.
Khan!

Inter-networking
1983
Vint C.
Bob K.
TCP / IP v1
Yo, our
network
works!
Yeah, but multiple
networks would be
...
Mo betta!
Let’s do
this!

Inter-networking
1983
Vint C.
Bob K.
TCP / IP v2
Yo, our
network
works!
Yeah, but multiple
networks would be
...
Mo betta!
Let’s do
this!

Inter-networking
1983
Vint C.
Bob K.
TCP / IP v3
Yo, our
network
works!
Yeah, but multiple
networks would be
...
Mo betta!
Let’s do
this!

Inter-networking
1983
Vint C.
Bob K.
TCP / IP v4
Yo, our
network
works!
Yeah, but multiple
networks would be
...
Mo betta!
Let’s do
this!
… still used today

Whoa, with the Internet,
other computers are
handling my data. How
can I send secrets?

Crypto getting better
1977 Data
Encryption
Standard

Crypto getting better
1977 Data
Encryption
“STANDARD”
The first openly
published and
standardized
encryption cipher.
A symmetric block
cipher.

Symmetric
Cryptography
Same Key.
genkey() = K
senc(K, M) = C
sdec(K, C) = M
DES:
- 56 bit key
- Block size: 64 bits
FAST!

Block Cipher Mode: Electronic Code Book

Houston ...
original w/ ECB
w/ mode w/ better
randomness

Cipher Block Chaining: Better than ECB

Simple and sweet
Alice
Bob
C = senc(K, M)
K K
M = sdec(K, C)

What if someone in the
middle changes my
message in transit?

Enter the
cryptographic hash
function
One Way Function.
Arbitrary length input;
fixed length output.
hash(M1) = digest1
hash(M2) = digest2
Hard to convert digest1 to M1.
Hard to find My that has the
same digest of a Mx. (collision)
“Work horse of modern crypto”
FAST!

Foundational work done in the
1970s by Ralph Merkle (more on
him later), et. al.
You’ll see Ronald Rivest’s name
pop up again as well.

Keyed-Hash
Message
Authentication
Code (HMAC)
Provides integrity and authenticity
HMAC(M, K) = hash(M + K)
(it’s actually a bit more
complicated but that’s the gist)
If recipient of M + HMAC(M, K)
has K, then:
Recipient can verify that M was
not modified in transit.

MAC then Encrypt. One type of attempt at providing integrity.
Alice
Bob
C = senc(K, M + hmac(K, M))
K K
Bob:
M’ + x = sdec(K, C)
x == hmac(K, M’)?
If true: then M’ is
legit

How can two remote
parties securely share a
key?

Diffie-Hellman (and Merkle) Key Exchange
1976
Whitfield D.
Martin H.
Ralph M.

Diffie-Hellman (and Merkle) Key Exchange
1976
Whitfield D.
Martin H.
Ralph M.
Asymmetric
Cryptography!

Discrete logarithms w/ very large numbers is computationally infeasible
Alice
Bob
p, g
a b
x = (g^a)mod p
y = (g^b)mod p
K = (y^a) mod p
K = (g^(ab)) mod p
K = (x^b) mod p
K = (g^(ab)) mod p
4 3
23, 5
c = senc(K, M)
4
10
18 18

How does Alice know if
she’s communicating
with Bob, or an
imposter?

Enter … public key crypto
1976
Ron R.
Adi S. Leonard A.
Discrete
logarithms
is hard.
You know
what else
is hard?
FACTORING
LARGE
NUMBERS INTO
PRIMES!
R-S-A!

(Asymmetric)
Public Key
Cryptography
DIFFERENT Keys.
genkeypair() = (Kpr, Kpb)
penc(Kpb, M1) = C1
pdec(Kpr, C1) = M1
penc(Kpr, M2) = C2
pdec(Kpb, C2) = M2
RSA:
- 2048 bit private key
(common)
SLOW!

public key crypto for confidentiality
Alice
Bob
C = penc(KpbB, M)
(KprA, KpbA), KpbB KpbA, (KprB, KpbB)
Bob:
M = pdec(KprB, C)
Trusted Source
Only Bob can decrypt,
b/c only he has his
private key!

What about integrity and
authenticity with public
key crypto?

Digital Signatures
Alice
Bob
C = penc(KpbB, M)
Bob:
M’ = pdec(KprB, C)
Trusted Source
DS = penc(KprA, hash(M))
digest’ = pdec(KpbA, DS)
hash(M’) == digest’ ?
DS: A (rudimentary)
“Digital Signature”

The first digital signature standard
Taher E.
19941984 Elgamal Digital
Signature Scheme

The first digital signature standard
Taher E.
19941984 Elgamal Digital
Signature Scheme
He’ll be back!

But public key crypto is
SLOW!

Public key + symmetric key encryption
Alice
Bob
C = senc(K, M + hmac(K, M))
Trusted Source
CK = penc(KpbB, K)
K = genkey()
DS = penc(KprA, hash(K))
Message
integrity
Message
integrity
Message
integrity
Not so slow
since payloads
are small
Fast for
large m

We can also use public
key crypto to
authenticate a Diffie-
Hellman key exchange,
right?

key crypto to
right?
YES!

key crypto to
right?
YES! (not shown)

It’s Worldwide. It’s a Web
Tim B-L
This Internet
thing is great!
Could it
support a
system of ...
1989 … documents
interconnected
w/ hyperlinks?
It would be
public to
everyone.
It would be
worldwide.
It would resemble
a spider web!

A couple of guys who didn’t ever do anything
Tim B-L Vint C.

Early growth of web browsers
1990
Tim B-L

1990
Tim B-L
1993
Marc A.

1990
Tim B-L
1993 1994
Marc A.

Birth of the Secure Sockets Layer Protocol
1995
Taher E.
He’s back!

Birth of the Secure Sockets Layer Protocol
1995
Taher E.
The Web is being
used more and
more everyday by
individuals.
Corporations and
governments have
the resources and
know-how to
protect their data
on the Internet.
Individuals’ data
are being sent in
PLAINTEXT!
We can use all that
crypto from the
previous slides for ...
Chief
Scientist

The end-to-end principle
1981
Dumb
DumbSmart
Taher E.
1995
Put the
security here

Transport Layer Security
1999
Standards body Internet
Engineering Task Force
converts SSL to a standard
called
Transport Layer Security.

Goals of
SSL/TLS
Some of them anyway
● Honor the end-to-end principle
● Confidentiality
● Integrity
● Server authentication
Later goals:
● Client authentication
● Forward secrecy

SSL / TLS versions
Protocol Published Notes
SSL 1.0 never Immediately deemed too insecure.
SSL 2.0 1995 IETF prohibition in 2011.
SSL 3.0 1996 IETF prohibition in June 2015.
TLS 1.0 1999 “SSL 3.1”. Standardized by the IETF. Supports downgrade to SSL 3.0. Deprecated
by PCI in June 2018.
TLS 1.1 2006 Added protections against CBC vulnerabilities.
TLS 1.2 2008 Prohibits downgrade to SSL. Mandates use of improved hash functions. Supports
enhanced encryption modes.
TLS 1.3 2018 Mandates forward secrecy. Prohibits non-AEAD cipher suites.

An Overview of the TLS Protocol
TCP Handshake
Client Server
Server Authentication
Optional Client Authentication
Cipher Suite Agreement
Secure Tunnel Established
Instead of just
one symmetric
key, the hosts will
continually
generate new
keys.

An Overview of the TLS Protocol
TCP Handshake
Client Server
Optional Client Authentication
Secure Tunnel Established

Remember?
Alice
Bob
Trusted Source
What does this
“Trusted Source”
look like?

X.509 Certificates
Name: Bob
Public Key:
2k3f98j2f92fjjf2903 …
Signature:
vmew90v33 …
Signed By: Cert Auth X
Name: Cert Auth X
Public Key: 9d3md9s …
Signature:
1kd09nf …
Signed By: self
Certificate of
Certificate
Authority aka
“trusted third
party”
Certificate
Recipient
Certificate
Trusted CAs are pre-
configured in browsers
and are kept up-to-date
over time.

Client Server
Hello, I’d like to talk
Here’s my signed certificate (+ integrity info)
Verify signed by
trusted party.
Verify name.
Verify integrity + signature.
Standard default is:
Name == domain name

Mutual Authentication
Client Server
Hello, I’d like to talk
Here’s my signed certificate (w/ integrity). Give me yours.
Verify name.
Here’s my signed certificate (w/ integrity).
Verity name.
Verify signature is by
trusted party.
Verify signature is by
trusted party..

Cipher Suites
Per Wikipedia:
TLS_RSA_WITH_NULL_MD5 TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA TLS_DH_anon_WITH_RC4_128_MD5
Key exchange with RSA. RSA
provides authentication.
Key agreement with Diffie-
Hellman. Authentication with
DSS/DSA.
Key agreement with Diffie-
Hellman. Anonymous: no
authentication.

Cipher Suites
Per Wikipedia:
No encryption: No
confidentiality.
Confidentiality encryption with Triple-
DES using the CBC mode. EDE
means “encrypt-decrypt-encrypt”.
Confidentiality encryption with
RC4 with 128 bit keys.

Cipher Suites
Per Wikipedia:
MD5 as the hash function
used in HMAC integrity
protection.
SHA-1 as the hash function used in
HMAC integrity protection.
MD5 as the hash function used
in HMAC integrity protection.

Cipher Suites
Per Wikipedia:
Don’t use NULL encryption.
3DES in TLS rendered “weak” by CVE-
2016-2183 aka “Sweet32”.
RC4 prohibited by IETF in Feb
2015. Also, you probably want
server authentication and not
anonymity.

Well what ciphers can I
use? How can I keep up?

Somebody mentioned
something called
“forward secrecy”.

A Problem with RSA Key Exchange
Client Server
TCP handshake. Authentication. Cipher suite agreement.
Let’s use this symmetric key for fast encryption
Traffic encrypted using symmetric key(s)
derived from C.
(KprS, KpbS)
C = penc(KpbS, genkey())
KpbS
Mr Spy
Captures trafficCaptures traffic
Later, steals
KprS.
Later, with kprS, Spy can decrypt the
symmetric key(s), and read ALL the data.

A Problem with RSA Key Exchange
Client Server
TCP handshake. Authentication.
Traffic encrypted using symmetric key(s)
derived from c.
“Ephemeral” Diffie-Hellman Key Agreement,
and remainder of cipher suite agreement.
Mr Spy
Captures trafficCaptures traffic
Later, steals
KprS.
W/o the private DH values, Spy cannot
recover the encryption keys
(KprS, KpbS)KpbS
Discard DH
values and
symmetric keys
Discard DH
values and
symmetric keys

RIP
1028 bit RSA
Certificates
Killed by CA/Browser
Forum because 768 bit
certs have been
broken and this was
next.
1988 - 2013

RIP
Secure
Sockets Layer
Killed by IETF.
Replaced by TLS.
1995 - 2015

RIP
RC4 Cipher
Killed by IETF.
In TLS
1995 - 2015

RIP
SHA-1
Certificates
Killed by CA/Browser
Forum.
Replaced by SHA-2.
1988 - 2017

RIP
Cipher Block
Chaining Mode
Killed by IETF
in TLS 1.3.
Replaced by AEAD.
In TLS
1995 - 2018

RIP
Plaintext HTTP
Killed by Chrome 68.
1990 - 2018

RIP
Symantec
Certificates
Killed by Chrome and
Firefox in response to
apparent certificate
mismanagement.
? - 2018

To end on an interesting note ...

RIP
This
Presentation
Killed by time
constraints and/or
audience boredom.
Replaced by Q&A
and/or mass exodus.
2018 - 2018

TLS Secures the Web

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to TLS Secures the Web

Similar to TLS Secures the Web (20)

Recently uploaded

Recently uploaded (20)

TLS Secures the Web