TLS Record Protocol: Security Analysis and Defense-in-depth - - PowerPoint PPT Presentation

▶
tls record protocol security analysis and defense in
SMART_READER_LITE
LIVE PREVIEW

TLS Record Protocol: Security Analysis and Defense-in-depth - - PowerPoint PPT Presentation

May 03, 2023 167 likes •793 views

TLS Record Protocol: Security Analysis and Defense-in-depth Countermeasures for HTTPS Olivier Levillain, Baptiste Gourdin, Herv Debar ANSSI, Sekoia, Tlcom SudParis ASIACCS 2015 Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol

slide-1
SLIDE 1

TLS Record Protocol: Security Analysis and Defense-in-depth Countermeasures for HTTPS

Olivier Levillain, Baptiste Gourdin, Hervé Debar

ANSSI, Sekoia, Télécom SudParis

ASIACCS 2015

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 1 / 31

slide-2
SLIDE 2

TLS in a nutshell

Client Server ClientHello ServerHello Certificate ServerHelloDone ClientKeyExchange ChangeCipherSpec Finished ChangeCipherSpec Finished Application Data

Cleartext Ciphertext

Two phases

◮ secure channel establishment

◮ algorithm negotiation ◮ server authentication ◮ key exchange to obtain a shared secret

◮ application data exchanges using this

channel

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 2 / 31

slide-3
SLIDE 3

TLS in a nutshell

Client Server ClientHello ServerHello Certificate ServerHelloDone ClientKeyExchange ChangeCipherSpec Finished ChangeCipherSpec Finished Application Data

Cleartext Ciphertext

Two phases

◮ secure channel establishment

◮ algorithm negotiation ◮ server authentication ◮ key exchange to obtain a shared secret

◮ application data exchanges using this

channel This talk focuses on the second phase, the Record Protocol

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 2 / 31

slide-4
SLIDE 4

TLS Record Protocol

After the handshake, records can be protected using 3 different schemes:

Stream cipher mode Plaintext P Compressed C C MAC Authenticated and Encrypted record |P| < 214 |C| < |P| + 1024 Compression (optional) MAC'ed then Encrypted record MAC'ed then Padded then Encrypted record C MAC C MAC

P a d

Encryption (XOR) C MAC Padding Encryption (CBC) CBC mode MAC MAC AEAD step AEAD mode Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 3 / 31

slide-5
SLIDE 5

Well, all started... in 2011

◮ 2011 : BEAST

◮ CBC mode with implicit IV

◮ 2012 : CRIME (followed by TIME and BREACH)

◮ Compression attacks

◮ 2013 - 2014 : Lucky13 (followed by POODLE)

◮ CBC Padding Attacks

◮ 2014 : RC4 biases (no real name)

◮ RC4 statistical biases Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 4 / 31

slide-6
SLIDE 6

The cookie monsters

◮ BEAST, TIME, CRIME, BREACH, Lucky13, POODLE, RC4 biases,

...

◮ all the PoCs went after cookies ◮ all relies on having the cookie repeated inside the TLS channel Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 5 / 31

slide-7
SLIDE 7

Model

Web Application (PHP, Python, NodeJS, …) (Django, ...) Web Server HTTP + SSL/TLS (Apache2, IIS, Nginx) Web Client (Chrome, Firefox, IE, ...) Application page Session Cookie

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 6 / 31

slide-8
SLIDE 8

RFC6265: HTTP State Management Mechanism

Server Web application Set-Cookie: session_id=C564A5F3EB; httponly;secure Cookie: session_id=C564A5F3EB setcookie('session_id', 'C564A5F3EB', httponly, secure) $_COOKIE['session_id'] contains 'C564A5F3EB' Client $_COOKIE['session_id'] contains 'C564A5F3EB' Cookie: session_id=C564A5F3EB $_COOKIE['session_id'] contains 'C564A5F3EB' $_COOKIE['session_id'] contains 'C564A5F3EB'

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 7 / 31

slide-9
SLIDE 9

Attacker Model

Web Application (PHP, Python, NodeJS, …) (Django, ...) Web Server HTTP + SSL/TLS (Apache2, IIS, Nginx) Web Client (Chrome, Firefox, IE, ...) Application page Attacker Page Attacker

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 8 / 31

slide-10
SLIDE 10

Summary of the proposed countermeasures

Countermeasures Beast L 13 RC4 *IME POODLE Structural changes to TLS Use TLS 1.0 + Use TLS 1.1 + + Encrypt-then-MAC + Changes related to TLS ciphersuites or compression methods Use CBC mode + Use RC4 + + + Use a new stream cipher + + + + Use AEAD (TLS 1.2) + + + + No TLS compression + Changes related to TLS implementations 1/n − 1 split + Constant-time CBC + Anti poodle splitting +

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 9 / 31

slide-11
SLIDE 11

Summary of the proposed countermeasures

Countermeasures Beast L 13 RC4 *IME POODLE Structural changes to TLS Use TLS 1.0 + Use TLS 1.1 + + Encrypt-then-MAC + Changes related to TLS ciphersuites or compression methods Use CBC mode + Use RC4 + + + Use a new stream cipher + + + + Use AEAD (TLS 1.2) + + + + No TLS compression + Changes related to TLS implementations 1/n − 1 split + Constant-time CBC + Anti poodle splitting +

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 9 / 31

slide-12
SLIDE 12

Summary of the proposed countermeasures

Countermeasures Beast L 13 RC4 *IME POODLE Structural changes to TLS Use TLS 1.0 + Use TLS 1.1 + + Encrypt-then-MAC + Changes related to TLS ciphersuites or compression methods Use CBC mode + Use RC4 + + + Use a new stream cipher + + + + Use AEAD (TLS 1.2) + + + + No TLS compression + Changes related to TLS implementations 1/n − 1 split + Constant-time CBC + Anti poodle splitting +

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 9 / 31

slide-13
SLIDE 13

Summary of the proposed countermeasures

Countermeasures Beast L 13 RC4 *IME POODLE Structural changes to TLS Use TLS 1.0 + Use TLS 1.1 + + Encrypt-then-MAC + Changes related to TLS ciphersuites or compression methods Use CBC mode + Use RC4 + + + Use a new stream cipher + + + + Use AEAD (TLS 1.2) + + + + No TLS compression + Changes related to TLS implementations 1/n − 1 split + Constant-time CBC + Anti poodle splitting +

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 9 / 31

slide-14
SLIDE 14

Summary of the proposed countermeasures

Countermeasures Beast L 13 RC4 *IME POODLE Structural changes to TLS Use TLS 1.0 + Use TLS 1.1 + + Encrypt-then-MAC + Changes related to TLS ciphersuites or compression methods Use CBC mode + Use RC4 + + + Use a new stream cipher + + + + Use AEAD (TLS 1.2) + + + + No TLS compression + Changes related to TLS implementations 1/n − 1 split + Constant-time CBC + Anti poodle splitting +

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 9 / 31

slide-15
SLIDE 15

Summary of the proposed countermeasures

Countermeasures Beast L 13 RC4 *IME POODLE Structural changes to TLS Use TLS 1.0 + Use TLS 1.1 + + Encrypt-then-MAC + Changes related to TLS ciphersuites or compression methods Use CBC mode + Use RC4 + + + Use a new stream cipher + + + + Use AEAD (TLS 1.2) + + + + No TLS compression + Changes related to TLS implementations 1/n − 1 split + Constant-time CBC + Anti poodle splitting +

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 9 / 31

slide-16
SLIDE 16

Summary of the proposed countermeasures

Countermeasures Beast L 13 RC4 *IME POODLE Structural changes to TLS Use TLS 1.0 + Use TLS 1.1 + + Encrypt-then-MAC + Changes related to TLS ciphersuites or compression methods Use CBC mode + Use RC4 + + + Use a new stream cipher + + + + Use AEAD (TLS 1.2) + + + + No TLS compression + Changes related to TLS implementations 1/n − 1 split + Constant-time CBC + Anti poodle splitting +

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 9 / 31

slide-17
SLIDE 17

Summary of the proposed countermeasures

Countermeasures Beast L 13 RC4 *IME POODLE Structural changes to TLS Use TLS 1.0 + Use TLS 1.1 + + Encrypt-then-MAC + Changes related to TLS ciphersuites or compression methods Use CBC mode + Use RC4 + + + Use a new stream cipher + + + + Use AEAD (TLS 1.2) + + + + No TLS compression + Changes related to TLS implementations 1/n − 1 split + Constant-time CBC + Anti poodle splitting +

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 9 / 31

slide-18
SLIDE 18

Summary of the proposed countermeasures

Countermeasures Beast L 13 RC4 *IME POODLE Structural changes to TLS Use TLS 1.0 + Use TLS 1.1 + + Encrypt-then-MAC + Changes related to TLS ciphersuites or compression methods Use CBC mode + Use RC4 + + + Use a new stream cipher + + + + Use AEAD (TLS 1.2) + + + + No TLS compression + Changes related to TLS implementations 1/n − 1 split + Constant-time CBC + Anti poodle splitting +

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 9 / 31

slide-19
SLIDE 19

Summary of the proposed countermeasures

Countermeasures Beast L 13 RC4 *IME POODLE Structural changes to TLS Use TLS 1.0 + Use TLS 1.1 + + Encrypt-then-MAC + Changes related to TLS ciphersuites or compression methods Use CBC mode + Use RC4 + + + Use a new stream cipher + + + + Use AEAD (TLS 1.2) + + + + No TLS compression + Changes related to TLS implementations 1/n − 1 split + Constant-time CBC + Anti poodle splitting +

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 9 / 31

slide-20
SLIDE 20

Summary

◮ Since 2011, seven attacks affecting the Record Protocol

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 10 / 31

slide-21
SLIDE 21

Summary

◮ Since 2011, seven attacks affecting the Record Protocol ◮ Generally, each attack has been thwarted using a specific fix

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 10 / 31

slide-22
SLIDE 22

Summary

◮ Since 2011, seven attacks affecting the Record Protocol ◮ Generally, each attack has been thwarted using a specific fix ◮ TLS 1.2 with AEAD suites offer a clean fix for most attacks

◮ But ... TLS 1.2 is not implemented everywhere ◮ But ... Older versions still supported Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 10 / 31

slide-23
SLIDE 23

Summary

◮ Since 2011, seven attacks affecting the Record Protocol ◮ Generally, each attack has been thwarted using a specific fix ◮ TLS 1.2 with AEAD suites offer a clean fix for most attacks

◮ But ... TLS 1.2 is not implemented everywhere ◮ But ... Older versions still supported

◮ A common denominator: all PoCs target repeated secrets

◮ cookies or anti-CSRF tokens Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 10 / 31

slide-24
SLIDE 24

Summary

◮ Since 2011, seven attacks affecting the Record Protocol ◮ Generally, each attack has been thwarted using a specific fix ◮ TLS 1.2 with AEAD suites offer a clean fix for most attacks

◮ But ... TLS 1.2 is not implemented everywhere ◮ But ... Older versions still supported

◮ A common denominator: all PoCs target repeated secrets

◮ cookies or anti-CSRF tokens

◮ What if we could avoid this repetition ?

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 10 / 31

slide-25
SLIDE 25

First-order attacks

Considered attacks: for each encrypted record, the attacker can retrieve some information about κ consecutive bytes of plaintext

◮ Typically, κ = 1 and the attacker can check whether a cleartext byte

is equal to a guessed value (e.g. Lucky13)

◮ Sometimes, the attacker must aggregate information resulting from

several records (e.g. RC4 biases)

◮ Even if it can be raised, κ is at most 4 in realistic scenarios ◮ Such attacks can be called first-order attacks

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 11 / 31

slide-26
SLIDE 26

The Masking Principle

As for the term first-order attacks, we borrow from the side-channel attacks litterature the masking principle.

◮ Each time a secret s of κ bytes must be transmitted ◮ Pick a random value m (the mask) of the same length ◮ Send the pair (m, m ⊕ s) ◮ Thus, the value can trivially be recomputed ◮ But the representation on the wire is different for every message

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 12 / 31

slide-27
SLIDE 27

The Masking Principle

As for the term first-order attacks, we borrow from the side-channel attacks litterature the masking principle.

◮ Each time a secret s of κ bytes must be transmitted ◮ Pick a random value m (the mask) of the same length ◮ Send the pair (m, m ⊕ s) ◮ Thus, the value can trivially be recomputed ◮ But the representation on the wire is different for every message ◮ Since the attacker can only recover information about κ consecutive

bytes for each record, she only obtains random data

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 12 / 31

slide-28
SLIDE 28

Masking the TLS layer

Stream cipher mode Plaintext P Compressed C C MAC Authenticated and Encrypted record |P| < 214 |C| < |P| + 1024 Compression (optional) MAC'ed then Encrypted record MAC'ed then Padded then Encrypted record C MAC C MAC

P a d

Encryption (XOR) C MAC Padding Encryption (CBC) CBC mode MAC MAC AEAD step AEAD mode Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 13 / 31

slide-29
SLIDE 29

Masking the TLS layer

◮ In practice, TLS Compression layer allows almost any reversible

transformation of the plaintext

r1 r2 r3 r4 r5 m m m m m m c1 c2 c3 c4 c5 m

Random

Compressed Record

=

Record Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 14 / 31

slide-30
SLIDE 30

Masking the TLS layer

◮ In practice, TLS Compression layer allows almost any reversible

transformation of the plaintext

r1 r2 r3 r4 r5 m m m m m m c1 c2 c3 c4 c5 m

Random

Compressed Record

=

Record

◮ This toy implementation does not follow the principle edicted before,

since the whole record is masked, not just the secret

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 14 / 31

slide-31
SLIDE 31

Implementation

OpenSSL implementation

◮ New compression method : scramble ◮ 75-line patch to add the scramble method ◮ Mask length is set to 8 ◮ Some minor patches needed to add scramble support into s_client

and s_server

◮ CPU and network bandwidth are negligible ◮ In practice, compression is now obsolete in TLS, so deploying a new

compression method is irrelevant

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 15 / 31

slide-32
SLIDE 32

Security analysis

◮ The first BEAST proof of concept used WebSockets ◮ It was thwarted when 4-byte masking was introduced to avoid some

confusion attacks

◮ TLS scrambling would thus thwart BEAST ◮ It should also work against Lucky 13, RC4 single-byte biases and

POODLE

◮ Yet, it does not only mask the secrets, so some attacks still work

(e.g.: application-level compression)

◮ It should only be considered as a toy implementation

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 16 / 31

slide-33
SLIDE 33

Masking at the HTTP Layer

Web Application (PHP, Python, NodeJS, …) (Django, ...) Web Server HTTP + SSL/TLS (Apache2, IIS, Nginx) Web Client (Chrome, Firefox, IE, ...) Application page Attacker Page Attacker Session Cookie

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 17 / 31

slide-34
SLIDE 34

RFC6265: HTTP State Management Mechanism

Server Web application Set-Cookie: session_id=C564A5F3EB; httponly;secure Cookie: session_id=C564A5F3EB setcookie('session_id', 'C564A5F3EB', httponly, secure) $_COOKIE['session_id'] contains 'C564A5F3EB' Client $_COOKIE['session_id'] contains 'C564A5F3EB' Cookie: session_id=C564A5F3EB $_COOKIE['session_id'] contains 'C564A5F3EB' $_COOKIE['session_id'] contains 'C564A5F3EB'

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 18 / 31

slide-35
SLIDE 35

MCookies

◮ Objective: use a random mask for each sent cookie ◮ Targets: secure & httpOnly cookies ◮ How: for each server response, send a fresh pair (m, m ⊕ c)

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 19 / 31

slide-36
SLIDE 36

MCookies

Server Web application Set-Cookie: session_id=5437624523:9153c7b6c8; httponly;secure setcookie('session_id', 'C564A5F3EB', httponly, secure) Client

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 20 / 31

slide-37
SLIDE 37

MCookies

Server Web application Set-Cookie: session_id=5437624523:9153c7b6c8; httponly;secure Cookie: session_id=5437624523:9153c7b6c8 setcookie('session_id', 'C564A5F3EB', httponly, secure) $_COOKIE['session_id'] contains 'C564A5F3EB' Client Set-Cookie: session_id=cb06ae36cc:0e620bc527; httponly;secure

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 20 / 31

slide-38
SLIDE 38

MCookies

Server Web application Set-Cookie: session_id=5437624523:9153c7b6c8; httponly;secure Cookie: session_id=5437624523:9153c7b6c8 setcookie('session_id', 'C564A5F3EB', httponly, secure) $_COOKIE['session_id'] contains 'C564A5F3EB' Client Cookie: session_id=cb06ae36cc:0e620bc527 $_COOKIE['session_id'] contains 'C564A5F3EB' Set-Cookie: session_id=974113a1ce:5225b65225; httponly;secure Set-Cookie: session_id=cb06ae36cc:0e620bc527; httponly;secure

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 20 / 31

slide-39
SLIDE 39

Implementation

◮ Implemented as a simple Apache2 module (500 loc)

◮ a2enmod mcookies is enough ◮ Works with sequential requests ◮ Works with parallel requests

◮ However some cookies attributes are lost in the process

◮ (Expires, Max-Age, Domain, Path) Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 21 / 31

slide-40
SLIDE 40

Implementation

◮ Expiration attribute is client side ◮ Session expiration should always be done server side. ◮ Fix 1: Add theses attributes to the MCookie

◮ Server response: (m:m ⊕ v:a) ◮ Client request: (m:m ⊕ v:a)

◮ Fix 2: Configure the Apache module

◮ vim /etc/apache2/mods-enabled/... Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 22 / 31

slide-41
SLIDE 41

Experiment

◮ Result: it works but it forces the server to re-emit a cookie each time ◮ Overhead ? ◮ Experiment scenario

◮ Simulate an active user browsing internet services ◮ Dump the HTTP traffic ◮ Emulate the same traffic using MCookies for each Secure+httpOnly

cookie

Traffic type Raw volume Overhead

  • Overh. optim.

Sensitive 24 MB +20.1 % +14.9 % Overall 122 MB +4.1 % +3.0 %

Table: Experiment result

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 23 / 31

slide-42
SLIDE 42

What if the browser could handle the masking ?

Web Application (PHP, Python, NodeJS, …) (Django, ...) Web Client (Chrome, Firefox, IE, ...) Application page Attacker Page Attacker Web Server HTTP + SSL/TLS (Apache2, IIS, Nginx) Session Cookie

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 24 / 31

slide-43
SLIDE 43

Masked-Cookies

Idea:

◮ The server can specify which cookies to protect ◮ The browser now sends a fresh (m, m ⊕ v) with each request. ◮ No more overhead.

Proposal:

◮ masked attribute:

◮ Set-Cookie: cookie=val;secure;httponly;masked Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 25 / 31

slide-44
SLIDE 44

Masked-Cookies

Server Web application Set-Cookie: session_id=5437624523:9153c7b6c8; httponly;secure;masked setcookie('session_id', 'C564A5F3EB', httponly, secure) Client

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 26 / 31

slide-45
SLIDE 45

Masked-Cookies

Server Web application Set-Cookie: session_id=5437624523:9153c7b6c8; httponly;secure;masked Masked-Cookie: session_id=5437624523:9153c7b6c8 setcookie('session_id', 'C564A5F3EB', httponly, secure) $_COOKIE['session_id'] contains 'C564A5F3EB' Client

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 26 / 31

slide-46
SLIDE 46

Masked-Cookies

Server Web application Set-Cookie: session_id=5437624523:9153c7b6c8; httponly;secure;masked Masked-Cookie: session_id=5437624523:9153c7b6c8 setcookie('session_id', 'C564A5F3EB', httponly, secure) $_COOKIE['session_id'] contains 'C564A5F3EB' Client Masked-Cookie: session_id=cb06ae36cc:0e620bc527 $_COOKIE['session_id'] contains 'C564A5F3EB'

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 26 / 31

slide-47
SLIDE 47

Implementation

◮ Implemented as a simple Apache2 module (500 loc) ◮ and a patch for chromium. (200 loc)

◮ Works with sequential requests ◮ Works with parallel requests Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 27 / 31

slide-48
SLIDE 48

MCookies Vs Masked-Cookies

◮ Same experiment scenario

Raw Extra bandwidth Traffic traffic w/o UA support with UA type volume naive

  • ptim.

support Sensitive 24 MB +20.1 % +14.9 % +10.8 % Overall 122 MB +4.1 % +3.0 % +2.2 %

Table: Network overhead evalulation

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 28 / 31

slide-49
SLIDE 49

MCookies Vs Masked-Cookies

◮ CPU Overhead ?

MCookies enabled Vanilla w/o UA with UA server support support Static page 384 318 (-17 %) 382 Wordpress page 221 212 (-4 %) 220

Table: Performance results (transactions/second)

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 29 / 31

slide-50
SLIDE 50

Summary

◮ Recent attacks on TLS Record Protocol rely on a repeated secret

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 30 / 31

slide-51
SLIDE 51

Summary

◮ Recent attacks on TLS Record Protocol rely on a repeated secret ◮ Our proposal to implement defense-in-depth: break this repetition

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 30 / 31

slide-52
SLIDE 52

Summary

◮ Recent attacks on TLS Record Protocol rely on a repeated secret ◮ Our proposal to implement defense-in-depth: break this repetition ◮ MCookies and Masked Cookies can be implemented and work

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 30 / 31

slide-53
SLIDE 53

Summary

◮ Recent attacks on TLS Record Protocol rely on a repeated secret ◮ Our proposal to implement defense-in-depth: break this repetition ◮ MCookies and Masked Cookies can be implemented and work ◮ POODLE validated our approach

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 30 / 31

slide-54
SLIDE 54

Summary

◮ Recent attacks on TLS Record Protocol rely on a repeated secret ◮ Our proposal to implement defense-in-depth: break this repetition ◮ MCookies and Masked Cookies can be implemented and work ◮ POODLE validated our approach ◮ Yet, secret randomization is a palliative countermeasure, not the

ultimate fix

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 30 / 31

slide-55
SLIDE 55

Summary

◮ Recent attacks on TLS Record Protocol rely on a repeated secret ◮ Our proposal to implement defense-in-depth: break this repetition ◮ MCookies and Masked Cookies can be implemented and work ◮ POODLE validated our approach ◮ Yet, secret randomization is a palliative countermeasure, not the

ultimate fix

◮ MCookies should be useful as a defense-in-depth countermeasure,

to get some time to patch

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 30 / 31

slide-56
SLIDE 56

Questions

Questions?

Thank you for your attention

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 31 / 31

slide-57
SLIDE 57

Questions

Some history

◮ 1994: Netscape publishes SSLv2 (https:// is born) ◮ 1995: Netscape publishes SSLv3, which fixes major flaws ◮ 1999: TLS 1.0 (aka SSLv3.1) is standardised by the IETF ◮ 2006: TLS 1.1 fixes bugs in CBC mode and updates ciphersuites ◮ 2008: TLS 1.2 introduces modern cryptographic modes ◮ 2015 (?): TLS 1.3 is coming

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 31 / 31

slide-58
SLIDE 58

Questions

Some history

◮ 1994: Netscape publishes SSLv2 (https:// is born) ◮ 1995: Netscape publishes SSLv3, which fixes major flaws ◮ 1999: TLS 1.0 (aka SSLv3.1) is standardised by the IETF ◮ 2006: TLS 1.1 fixes bugs in CBC mode and updates ciphersuites ◮ 2008: TLS 1.2 introduces modern cryptographic modes ◮ 2015 (?): TLS 1.3 is coming

SSLv2 hopefully is history: this talk is about SSLv3 - TLS

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 31 / 31

slide-59
SLIDE 59

Questions

CBC mode with implicit IV

◮ Attack name: BEAST ◮ Authors: Rogaway (theoretic), Duong and Rizzo (practical attack) ◮ Date: 1995 (theoretic), 2011 (practical attack) ◮ Hypotheses and prerequisites:

◮ the TLS connection uses CBC with an implicit IV ◮ the ciphertext is observable ◮ the plaintext is partially controlled, adaptively ◮ the same secret is repeated in different connections

◮ Ideal fix: use TLS 1.1 (explicit IV) ◮ Common fix: split records to randomize IV in practice

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 31 / 31

slide-60
SLIDE 60

Questions

Compression attacks

◮ Attack name: CRIME (followed by TIME and BREACH) ◮ Authors: Duong and Rizzo ◮ Date: 2012 (practical attack) ◮ Hypotheses and prerequisites:

◮ a form of compression is enabled (TLS or HTTP) ◮ the ciphertext length is observable (packet size or timing difference) ◮ plaintext can be loosely controlled ◮ the same secret is repeated in different connections

◮ Ideal fix: avoid mixing attacker-controlled data and secrets ◮ Common fix: disable compression

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 31 / 31

slide-61
SLIDE 61

Questions

CBC Padding Attacks

◮ Attack name: Lucky13 (followed by POODLE) ◮ Authors: Vaudenay (theoretic), AlFardan et al. (Lucky13) and

Moeller et al. (POODLE)

◮ Date: 2002 (theoretic), 2013-2014 (practical attack) ◮ Hypotheses and prerequisites:

◮ the connection uses CBC ◮ the decryption process leaks information (Lucky13), or ◮ the decryption uses SSLv3-style padding (POODLE) ◮ the attacker can intercept and modify network packets ◮ the same secret is repeated in different connections

◮ Ideal fix: use Encrypt-then-Mac or proper authenticated encryption ◮ Common fix (Lucky13): implement constant-time CBC decryption ◮ Common fix (POODLE): get rid of SSLv3

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 31 / 31

slide-62
SLIDE 62

Questions

RC4 statistical biases

◮ Attack name: RC4 biases (no real name) ◮ Authors: AlFardan et al. (practical attack) ◮ Date: 2014 ◮ Hypotheses and prerequisites:

◮ RC4 is used to encrypt data ◮ the ciphertext is observable ◮ the same secret is repeated in different connections

◮ Ideal fix: ban RC4 ◮ Common fix: ban RC4 when possible

Levillain, Gourdin, Debar (ASIACCS) TLS Record Protocol Security Analysis and Countermeasures 31 / 31