International Journal of Computer Network and Information Security (IJCNIS)
IJCNIS Vol. 8, No. 2, 8 Feb. 2016
Cover page and Table of Contents: PDF (size: 434KB)
Author(s)
Index Terms
SSL/TLS, vulnerabilities, Man-In-The-Middle (MITM) attack, mitigations, taxonomy of attacks
Abstract
Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols use cryptographic algorithms to secure data and ensure security goals such as Data Confidentiality and Integrity in networking. They are used along with other protocols such as HTTP, SMTP, etc. in applications such as web browsing, electronic mail, and VoIP. The existing versions of the protocols as well as the cryptographic algorithms they use have vulnerabilities and is not resistant towards Man-In-The- Middle (MITM) attacks. Exploiting these vulnerabilities, several attacks have been launched on SSL/TLS such as session hijacking, version degradation, heart bleed, Berserk etc. This paper is a comprehensive analysis of the vulnerabilities in the protocol, attacks launched by exploiting the vulnerabilities and techniques to mitigate the flaws in protocols. A novel taxonomy of the attacks against SSL/TLS has been proposed in this paper.
Cite This Paper
Keerthi Vasan K., Arun Raj Kumar P., "Taxonomy of SSL/TLS Attacks", International Journal of Computer Network and Information Security(IJCNIS), Vol.8, No.2, pp.15-24, 2016. DOI:10.5815/ijcnis.2016.02.02
Reference
[1]S. Turner and T. Polk, "Prohibiting Secure Sockets Layer (SSL) Version 2.0", RFC 6176, IETF, March 2011.
[2]A. Freier, P. Karlton and P. Kocher, "The Secure Sockets Layer (SSL) Protocol Version 3.0", RFC 6101, IETF, August 2011.
[3]T. Dierks and C. Allen, "The TLS Protocol Version 1.0", RFC 2246, IETF, January 1999.
[4]T. Deirks and E. Rescorla, “The Transport Layer Security (TLS) Protocol Version 1.2”, RFC 5246, IETF, August 2008.
[5]M. Myers et al, “X.509 Internet Public Key Infrastructure Online Certificate Status Protocol – OCSP”, RFC 2560, IETF, June 1999.
[6]M.H. Momani and A.Z. Hudaib, “Comparative Analysis of Open-SSL Vulnerabilities & Heartbleed Exploit Detection”, International Journal of Computer Science and Security, vol 8, issue 4, 2014, pp 159 -176.
[7]www.heartbleed.com as seen on July 2015.
[8]Y. Sheffer and R. Holz, “Summarizing Known Attacks on Transport Layer Security (TLS)”, RFC 7457, IETF, February 2015.
[9]M.L. Das and N. Samdaria, “On the security of SSL/TLS-enabled applications”, Elsevier Applied Computing and Informatics, 2014, pp 68 – 81.
[10]M. Marlinspike,“New Tricks for Defeating SSL in Practice”, BlackHat Security, 2009
[11]www.thoughtcrime.org/software/sslstrip as seen on July 2015.
[12]en.wikipedia.org/wiki/STARTTLS as seen on July 2015.
[13]Y. Suga, “SSL/TLS Status Survey in Japan – Transitioning against the Renegotiation Vulnerability and Short RSA Key Length Problem”, IEEE Seventh Asia Joint Conference on Information Security, 2012, pp 17 – 24.
[14] K. Bhargavan et al, “Triple Handshakes and Cookie Cutters: Breaking and Fixing Authentication over TLS”, IEEE Symposium on Security and Privacy, 2014, pp 1 – 17.
[15]D. Brumley and D. Boneh, “Remote timing attacks are practical,” Proceedings of the 12th conference on USENIX Security Symposium - Volume 12, June 2003, pp 950-970.
[16]P. C. Kocher, “Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems,” in Proceedings of the 16th Annual International Cryptology Conference on Advances in Cryptology, UK: Springer-Verlag, August 1996, pp 104-113.
[17]N. AlFardan and K.G. Paterson, “Lucky thirteen: Breaking the TLS and DTLS record protocols”, IEEE Symposium on Security and Privacy, 2013, pp 526-540.
[18]D. Bleichenbacher, “Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1”, Springer-Verlag Berlin Heidelberg, 1998, pp 1- 12.
[19]V. Kl?ma, O. Pokorny, and T. Rosa, “Attacking RSA-Based Sessions in SSL/TLS,” in Cryptographic Hardware and Embedded Systems, Springer Berlin Heidelberg, vol. 2779, Sep. 2003, pp 426 – 440.
[20]J.Salowey et al, "Transport Layer Security (TLS) Session Resumption without Server-Side State", RFC 5077, IETF, May 2006.
[21]J. Rizzo and T. Duong, "Practical padding oracle attacks", Proceedings of the 4th USENIX conference on Offensive technologies, vol. 10, 2010, pp 881 – 885.
[22]B. Moller, T. Duong and K. Kotowicz, “This POODLE Bites: Exploiting the SSL 3.0 Fallback”, pp 1 – 4.
[23]www.intelsecurity.com/advanced-threat-research/berserk.html as seen on July 2015.
[24]S. Blake-Wilson et al, "Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)", RFC 4492, IETF, May 2006.
[25]J. Merkle and M. Lochter, "Elliptic Curve Cryptography (ECC) Brainpool Curves for Transport Layer Security (TLS)", RFC 7027, IETF, October 2013.
[26]T. Izu, M. Takenaka and T. Shimoyama, “Analysis on Bleichenbacher’s Forgery Attack”, IEEE Second International Conference on Availability, Reliability and Security, 2007, pp 1167 – 1174.
[27]J. Rizzo and T. Duong, "The CRIME attack", ekoparty Security Conference, vol. 8, 2012, pp 1 - 23
[28]cve.mitre.org/cve as seen on July 2015.
[29]J. Hodges and C. Jackson, “HTTP Strict Transport Security (HSTS)”, RFC 6797, IETF, November 2012.
[30]E. Rescorla, M. Ray and S. Dispensa, “Transport Layer Security (TLS) Renegotiation Indication Extension”, RFC 5746, IETF, February 2010.
[31]E. Rescorla, "TLS Elliptic Curve Cipher Suites with SHA-256/384 and AES Galois Counter Mode (GCM)", RFC 5289, IETF, August 2008.
[32]P. Chown, "Advanced Encryption Standard (AES) Ciphersuites for Transport Layer Security (TLS)", RFC 3268, IETF, June 2002.
[33]K. Bhargavan et al, “Implementing TLS with Verified Cryptographic Security”, IEEE Symposium on Security and Privacy, 2013, pp 445 – 459.
[34]R. Oppligera, R. Hauserb and D. Basinc, “SSL/TLS session-aware user authentication revisited”, Computers & Security, 2008, pp 467-476.