TLS 1.3: What has changed Dmitry Belyavskiy Cryptocom.

Slides:

Advertisements

Similar presentations

SSL/TLS Protocol Network Security Gene Itkis. Basic paradigmatic application: on-line purchase Client contacts Server (possibly for the first time) Spontaneity.

Advertisements

Lecture 6: Web security: SSL

TLS Introduction 14.2 TLS Record Protocol 14.3 TLS Handshake Protocol 14.4 Summary.

SMUCSE 5349/49 SSL/TLS. SMUCSE 5349/7349 Layers of Security.

17.1 Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display. Chapter 17 Security at the Transport Layer: SSL and TLS.

Socket Layer Security. In this Presentation: need for web security SSL/TLS transport layer security protocols HTTPS secure shell (SSH)

1 SSL/TLS 2 Web security Security requirements Secrecy to prevent eavesdroppers to learn sensitive information Entity authentication Message authentication.

COMP043-Cryptology Week 4 – Certs and Sigs. Digital Signatures Digital signatures provide –Integrity –Authenticity and –Non-repudiation How do they work?

ITA, , 8-TLS.pptx 1 Internet Security 1 (IntSi1) Prof. Dr. Andreas Steffen Institute for Internet Technologies and Applications (ITA) 8 Transport.

December 2006Prof. Reuven Aviv, SSL1 Web Security with SSL Prof. Reuven Aviv Dept. of Computer Science Tel Hai Academic College.

Apr 2, 2002Mårten Trolin1 Previous lecture On the assignment Certificates and key management –Obtaining a certificate –Verifying a certificate –Certificate.

0 SSL3.0 / TLS1.0 Secure Communication over Insecure Line.

Secure Socket Layer (SSL)

Behzad Akbari Spring 2012 (These slides are based on lecture slides by Lawrie Brown)

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

Proposed Transport Layer Security (TLS) Evidence Extensions Russ Housley IETF 67 – TLS WG Session.

December 2008Prof. Reuven Aviv, SSL1 Web Security with SSL Network Security Prof. Reuven Aviv King Mongkut’s University of Technology Faculty of information.

Web Security Network Systems Security

TLS user mapping hint extension Stefan Santesson Microsoft.

SMUCSE 5349/7349 SSL/TLS. SMUCSE 5349/7349 Layers of Security.

Secure Sockets Layer (SSL) Protocol by Steven Giovenco.

1 SSL/TLS. 2 Web security Security requirements Secrecy to prevent eavesdroppers to learn sensitive information Entity authentication Message authentication.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

Secure Socket Layer Protocol Dr. John P. Abraham Professor, UTRGV.

@Yuan Xue CS 285 Network Security Secure Socket Layer Yuan Xue Fall 2013.

Page 1 of 17 M. Ufuk Caglayan, CmpE 476 Spring 2000, SSL and SET Notes, March 29, 2000 CmpE 476 Spring 2000 Notes on SSL and SET Dr. M. Ufuk Caglayan Department.

Apr 1, 2003Mårten Trolin1 Previous lecture Certificates and key management Non-interactive protocols –PGP SSL/TLS –Introduction –Phases –Commands.

TLS: avoiding dangers A presentation by Dmitry Belyavsky, TCI Business Internet Conference Kiev, Ukraine, December 2013.

TLS/SSL Protocol Presented by: Vivek Nelamangala Includes slides presented by Miao Zhang on April Course: CISC856 - TCP/IP and Upper Layer Protocols.

IT443 – Network Security Administration Instructor: Bo Sheng

CSCI 555 Adv Computer Security

Network Security Gene Itkis

Mark Brown RedPhone Security

Reviews Rocky K. C. Chang 20 April 2007.

Avishai Wool Slides credit: Itamar Gilad

Secure Sockets Layer (SSL)

CSCE 715: Network Systems Security

GSS-API based Authentication and Key Establishment in TLS

CSE 4095 TLS Attacks.

Originally by Yu Yang and Lilly Wang Modified by T. A. Yang

CSE 4095 Transport Layer Security TLS, Part II

CSE 4095 Transport Layer Security TLS

Transport Layer Security (TLS) v1.3 Support in Java

Network Security: TLS/SSL

A Messy State of the Union: Taming the Composite State Machine of TLS

Cryptography and Network Security Chapter 16

MIDP Application Security

CSE 4095 TLS Attacks Continued

CS 465 TLS Last Updated: Oct 31, 2017.

SSL – Secure Socket Layer and TLS – Transport Layer Security

Secure Web Application-SSL

SSL (Secure Socket Layer)

Chapter 7 WEB Security.

Lecture 8: Transport Level Security – SSL/TLS

Security at the Transport Layer: SSL and TLS

CSCE 815 Network Security Lecture 16

TLS and DLP Behind the green lock.

SSL Protocol Figures used in the presentation

Cryptography and Network Security Chapter 16

Chapter 7 WEB Security.

Transport Layer Security (TLS)

TLS/1.2 and TLS/1.3 Highlights

Security at the Transport Layer

TLS Encryption and Decryption

Presentation transcript:

TLS 1.3: What has changed Dmitry Belyavskiy Cryptocom

History SSLv2 – 1995 SSLv3 – 1996 TLS1.0 – RFC 2246, 1999

TLS 1.3 design goals Better traffic protection Remove all unsafe stuff Make TLS faster

TLS 1.3: Handshake redesign ClientHello ServerHello Certificate ServerKeyExchange ServerHelloDone ClientKeyExchange [ChangeCipherSpec] Finished Application Data ClientHello +key_share ServerHello Certificate Finished {Application Data} Application Data

TLS 1.3 and DPI Before: non-encrypted SNI non-encrypted Certificate Now: non-encrypted server_name encrypted Certificate Future: encrypted SNI Certificate-based DPI is not applicable!

Faster content delivery Before TLS 1.3: 2 Round-trips TLS 1.3: 1 Round-trip Make CDNs happy Faster content delivery

Authentication and certificates RSA-PSS instead of PKCS1-v1.5 Avoid Bleichenbacher attacks No more DSA certificates No more static DH Brand-new PSK mode

Battle against surveillance PFS is mandatory Tries to re-enable unsafe methods: Return back RSA key exchange Allow repeat Diffie-Hellman random data 3-side protocol variations Motivation: debugging purposes Not accepted by community, to be continued

Cipher modes AES-128, AES-256, ChaCha AEAD modes only: AES-GCM, AES-CCM, ChaCha-Poly1305 No more: CBC modes DES/3DES, RC4, ARIA, CAMELLIA SHA1, MD5... No more compression

Ciphersuites Redesign Before: Ciphersuite = Key Exchange + Authentication + Cipher + MAC + PRF After: Key Exchange + Authentication AEAD-based cipher HKDF instead of PRF

0-RTT mode Reuse previously established keys NO perfect forward secrecy Vulnerable to replay attack

Problem: Middleboxes Try to simplify handshake Middleboxes do not recognize TLS 1.3 Redesign: make handshake more similar to previous handshake versions

Support OpenSSL 1.1.1 (when available) Mozilla Firefox, Google Chrome Cloudflare, Akamai...

Conclusions Almost brand-new The safest TLS protocol The fastest TLS protocol Waiting for encrypted SNI Waiting for DTLS Waiting for Russian GOST :)

Questions? beldmit@cryptocom.ru