1Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential PROXYSG SSL CRYPTO PROTOCOLS AND ALGORITHMS  Thank you for joining today’s Blue Coat Customer Support Technical Webcast! The Webcast will begin just a minute or so after the top of the hour to allow today’s very large audience sufficient time to join You may join the teleconference through the numbers provided in your invite, or listen through your computer speakers Audio broadcast will only go live when the Webcast begins – there will be silence until then The Presentation will run approximately 60 minutes There will be a 30-minute Q/A session thereafter  Please submit questions using the Webex Q/A feature!

2Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential PROXYSG SSL CRYPTO PROTOCOLS AND ALGORITHMS WEBCAST DENNIS PIKE Principal Systems Engineer April 14, 2015

3Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential AGENDA  Crypto Protocols and Algorithms  Recent Trends in SSL  ProxySG SSL Architecture  SSL Performance Factors  Best Practices  Troubleshooting

4Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat ConfidentialCopyright © 2013 Blue Coat Systems Inc. All Rights Reserved. Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved. 4 SSL CRYPTO PROTOCOLS AND ALGORITHMS

5Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential PARTS IS PARTS  SSLv?, TLS1.?  Handshake algorithm RSA, DHE, ECDHE  Authentication / Signing RSA, DSA, ECDSA  Bulk Encryption RC4, 3DES, AES*  Hash MD5, SHA1, SHA2/256 parameters.xhtml#tls-parameters-4

6Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat ConfidentialCopyright © 2013 Blue Coat Systems Inc. All Rights Reserved. Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved. 6 RECENT TRENDS IN SSL

7Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential SNOWDEN EFFECT Started release of classified NSA material in June Since then:  Global SSL connections at peak have more than doubled  Major web properties have gone default HTTPS and moved to more secure ciphers/algorithms 34 of Top 50 8 of Top 10 (baidu and qq are exceptions)  Web browsers are promoting better security through graphical look and error messages based on cryptography that is negotiated

8Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential HEARTBLEED AND POODLE AND BEAST OH MY!!!  Death to SSLv3!, Long live TLS1.2! Heartbleed – OpenSSL bug POODLE – SSLV3 Fallback exploit BEAST – TLS1.0 CBC exploit Forward Secrecy – private key decrypt (ie court order)

9Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential GOOGLE WHO?  MD-5 SHA-1 > SHA-2  All key properties are HTTPS  ECDHE for key exchange by choice if the browser supports it.  AES-GCM as the bulk cipher if the client supports it and is not Chrome  CHACHA as the bulk cipher if the client is Chrome

10Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential MOZILLA  It’s Hip to be Mod

11Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential MOZILLA

12Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential THE BIG SHIFT  January 2014 Bulk Cipher Handshake Protocol

13Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential THE BIG SHIFT  May 2014 Bulk Cipher (AES Up, 3DES Down) Handshake (ECDHE 21 -> 42%) Protocol (TLS > 54%) Cert Signing (SHA2 5 -> 10%)

14Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential SUMMARY  More and higher percentage SSL traffic  Stronger Hash / MAC (MD5 -> SHA-2)  Stronger Key Exchange Algorithm (Asymmetric Encryption) during Handshake (RSA -> ECDHE)  Stronger Symmetric Bulk Encryption during Data exchange (RC4/3DES -> AES)  Stronger Auth / Digital Signing (RSA -> {EC}DSA)

15Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat ConfidentialCopyright © 2013 Blue Coat Systems Inc. All Rights Reserved. Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved. 15 BLUE COAT PROXY SG SSL ARCHITECTURE

16Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential SSL INTERCEPT

17Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat ConfidentialCopyright © 2013 Blue Coat Systems Inc. All Rights Reserved. Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved. 17 PERFORMANCE FACTORS

18Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential SSL PERFORMANCE INFLUENCERS  Handshake –Protocol -> limited to no impact –Certificate Emulation -> expensive, one-time cost *  Asymmetric Key Exchange Cipher Algorithm –RSA vs DHE vs ECDHE -> DHE is high cost vs RSA/ECDHE Key Size –1024 vs 2048 vs > low/moderate (2048) to high (4096) Certificate Digital Signing –RSA vs DSA -> low (only ~5% of sites today) Certificate Hash –MD5 vs SHA-1/2 -> low  Bulk Encryption –RC4 vs AES -> low  Load –Roughly linear up to 80%

19Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential PERFORMANCE FACTORS ① Emulating Certificate Highest cost operation is the creation Emulated Certificate ② Wildcard Cert Cert collision preventing use of Emulated Cert ③ Key Exchange CPU Load RSA < ECDHE < DHE DHE 20x higher CPU load then ECDHE Highest Impact

20Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat ConfidentialCopyright © 2013 Blue Coat Systems Inc. All Rights Reserved. Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved. 20 BEST PRACTICES

21Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential BEST PRACTICES  Upgrade to >= SG Many new ciphers added in including: ECDHE-RSA-AES128-SHA (0xC013) ECDHE-RSA-AES256-SHA (0xC014) ECDHE-RSA-AES128-SHA256 (0xC027) ECDHE-RSA-AES128-GCM-SHA256 (0xC02F) ECDHE-RSA-RC4-SHA (0xC011) added ECDSA: ECDHE-ECDSA-AES128-SHA256 (0xC023) ECDHE-ECDSA-AES128-GCM-SHA256 (0xC02B) ECDHE-ECDSA-RC4-SHA (0xC007) ECDHE-ECDSA-AES128-SHA (0xC009) ECDHE-ECDSA-AES256-SHA (0xC00A)

22Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential BEST PRACTICES  Disable DHE DHE support was introduced but very CPU intensive patch has CLI to disable: #co t -> ssl -> proxy dhe-ciphers disable Upgrade to >= , DHE for SSL proxy is now disabled by default (can still be enabled)  Reduce number of Emulated Certificates Upgrade to , use new CLI to increase certificate cache timeout to tune perf #co t -> ssl -> proxy set-cert-cache-timeout 72 hours to prevent Monday morning high load

23Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential BEST PRACTICES  Wildcard certificates (eg *.google.com and others) Different servers have different certs (different expiration, keys, extensions, etc) SG’s emulated certificates are cached using “CN” as the key value SG is seeing these different certs all with the same CN, causing a collision in the certificate cache and forcing SG to re-emulate certificate Future certificate cache enhancement planned, use policy resolution below  Wildcard certificates Resolution Install the following policy (creates a unique instance for each certificate) ssl.forward_proxy(https) ssl.forward_proxy.splash_text("$(x-rs-certificate- serial-number)$(x-rs-certificate-valid-from)$(x-rs- certificate-valid-to)") Monitor efficacy using % certificate emulations (=SPS51 / (SPS51 + SPS61))

24Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential BEST PRACTICES  From VPM, edit SSL-Intercept layer Click on "Splash Text" and paste the below text in the box: $(x-rs-certificate-serial- number)$(x-rs-certificate-valid- from)$(x-rs-certificate-valid-to)

25Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential BEST PRACTICES  Set Emulated Certificate Size to 1024 Blue Coat SG300 Series#conf t Enter configuration commands, one per line. End with CTRL-Z. Blue Coat SG300 Series#(config)ssl Blue Coat SG300 Series#(config ssl)proxy force- emulated-cert-keysize 1024 ok Valid values: auto, 1024 or 2048 Client side certificate but possible for server side to downgrade

26Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential SIZING If you haven’t enabled SSL Intercept (15% HTTPS, 70% CPU, 6.5 SGOS) If you are upgrading to >= 6.5 HTTPS Utilization has gone up over time 10-15% reduction in throughput reduction in throughput independent of HTTP

27Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential ENCRYPTED TRAFFIC MANAGEMENT SOLUTIONS SSL visibility & full Proxy policy control for web traffic only Selective decrypt maintains privacy (BCWF categories) Feeds decrypted traffic to AV, DLP solutions via ICAP Single output stream – Encrypted TAP (optional) SSL visibility & full Proxy policy control for web traffic only Selective decrypt maintains privacy (BCWF categories) Feeds decrypted traffic to AV, DLP solutions via ICAP Single output stream – Encrypted TAP (optional) ProxySG SSL Visibility SSL visibility & policy control for ALL SSL traffic (all ports, all traffic) Selective decryption maintains privacy (Host Categorization) Standalone, high-performance appliance – up to 4Gbps SSL Multiple output streams –Enhances IDS/IPS, NGFW, DLP, SWG, security analytics / forensics, compliance, malware analysis / sandbox, etc. SSL visibility & policy control for ALL SSL traffic (all ports, all traffic) Selective decryption maintains privacy (Host Categorization) Standalone, high-performance appliance – up to 4Gbps SSL Multiple output streams –Enhances IDS/IPS, NGFW, DLP, SWG, security analytics / forensics, compliance, malware analysis / sandbox, etc.

28Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat ConfidentialCopyright © 2014 Blue Coat Systems Inc. All Rights Reserved.28 TROUBLESHOOTING

29Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential OPEN ISSUES  Cipher compatibility TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) TLS_DH_anon_WITH_RC4_128_MD5 (0x0018) -> MS Lync Desktop sharing Investigating Workaround : Bypass in SSL Intercept Layer  Reverse Proxy limitations ECDHE not currently supported Will be added in future release

30Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential TESTING TOOLS  Client Ciphers  Server Ciphers

31Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential CPU LOAD  CPU monitor Enable – Create 5 min snapshots –KB3795 Don’t change the existing daily or hourly snapshot values

32Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential TRAFFIC MIX  Percentage HTTPS Statistics > Traffic Details > Traffic Mix

33Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential CERTIFICATE EMULATION STATISTICS (SG ) SPS51 Total certificates emulated2,264 SPS52 Total RSA 2048 bit key certificates emulated2,250 SPS53 Current cached emulated server certificates1,078 SPS54 Total emulated server certificates added to cache1,390 SPS55 Total emulated server certificates removed from cache due to timeout0 SPS56 Total emulated server certificates removed from cache due to maxsize0 SPS57 Total emulated server certificates removed from cache due to signature mismatch312 SPS58 Total emulated server certificates removed from cache due to config changes0 SPS59 Total emulated server certificates add to cache failures874 SPS61 Total server certificate cache successful lookups42,109 SPS62 Total proxy certificates emulated5 SPS63 Total certificate emulation failures0 % certificate emulation change = SPS51 / (SPS51 + SPS61) In steady state, % of new emulations should be very small SSL Statistics (in Sysinfo and SSL/Statistics URL) Certificate Emulation

34Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential SSL PROXY CERTIFICATE CACHE  Advanced URL SSL Proxy Certificate Cache URL_Path /sslproxy/certcache Certificate Cache Contents Number of cache entries: 1078 Common Name, Splash Text, Splash URL, Server Keyring rtax.criteo.com,, cloudfront.net,, s3.wpc.edgecastcdn.net,, beacon.walmart.com,, *.linkedin.com, FAAB168CFFE4A Ap r 17 12:30: GMT Apr 17 12:30: GMT, beis.cc.iup.edu,, *.widget.custhelp.com, BAC372720E3496C661336F0Feb 28 00:00: GMTMar 30 23:59: GMT, ads.dotomi.com,02F7CASep 3 03:33: GMTNov 5 14:50: GMT, *.wer.microsoft.com,28DB34EB Apr 4 17:56: GMTApr 4 17:56: GMT, *.ebay.com,, *.googleusercontent.com,, *.reson8.com,D3C03378DC74A2ABF36132E69E273C45Jun 2 00:00: GMTJul 21 23:59: GMT, stage.tracker.springserve.com,, services.addons.mozilla.org,, *.tapad.com,024906Jun 2 08:10: GMTSep 3 03:30: GMT, *.dropbox.com,, $(x-rs-certificate-serial-number) $(x-rs-certificate-valid-from) $(x-rs-certificate-valid-to)

35Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential

36Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential THANK YOU FOR JOINING TODAY!  Please provide feedback on this webcast and suggestions for future webcasts to:  Webcast replay and slide deck found here within 48 hours: support-technical-webcasts (Requires BTO log-in)

37Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential BLUE COAT CUSTOMER FORUMS  Community where you can learn from and share your valuable knowledge and experience with other Blue Coat customers  Research, post and reply to topics relevant to you at your own convenience  Blue Coat Moderator Team ready to offer guidance, answer questions, and help get you on the right track  Access at forums.bluecoat.com and register for an account today!forums.bluecoat.com

38Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential QUICK SURVEY We are truly committed to continuous improvement for these Technical Webcasts. At the end of the event you will be re- directed to a very short survey about satisfaction with this Program. Please help us out by taking two minutes to complete it. Thank you! Questions for Dennis?

39Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential Questions?

40Copyright © 2014 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential PROXYSG SSL WEBCAST QUESTIONS  Q1: