The first few milliseconds of HTTPS - nluug

Transcript

1. The first 200 milliseconds of HTTPS 1 Joshua Thijssen jaytaph
3. ➡ What’s happening in the first 200+ milliseconds in a initial HTTPS connection. 2
4. ➡ What’s happening in the first 200+ milliseconds in a initial HTTPS connection. ➡ Give tips and hints on hardening your setup. 2
5. ➡ What’s happening in the first 200+ milliseconds in a initial HTTPS connection. ➡ Give tips and hints on hardening your setup. ➡ Give you insights in new and upcoming technologies. 2
6. ➡ What’s happening in the first 200+ milliseconds in a initial HTTPS connection. ➡ Give tips and hints on hardening your setup. ➡ Give you insights in new and upcoming technologies. ➡ Show you things to you (probably) didn’t knew. 2
7. This talk is inspired by a blogpost from Jeff Moser http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html Unknown fact! 3
8. HTTPS == HTTP on top of TLS 4
9. Transport Layer Security (TLS) 5
10. Secure Socket Layer (SSL) 6 A short and scary history
11. then now 7
12. then now SSL 1.0 Vaporware 1994 7
13. then now feb 1995 SSL 2.0 Not-so-secure-socket-layer SSL 1.0 Vaporware 1994 7
14. then now feb 1995 SSL 2.0 Not-so-secure-socket-layer jun 1996 SSL 3.0 Something stable! SSL 1.0 Vaporware 1994 7
15. then now feb 1995 SSL 2.0 Not-so-secure-socket-layer jun 1996 SSL 3.0 Something stable! jan 1999 TLS 1.0 SSL 3.1 SSL 1.0 Vaporware 1994 7
16. then now feb 1995 SSL 2.0 Not-so-secure-socket-layer jun 1996 SSL 3.0 Something stable! jan 1999 TLS 1.0 SSL 3.1 apr 2006 TLS 1.1 SSL 1.0 Vaporware 1994 7
17. then now feb 1995 SSL 2.0 Not-so-secure-socket-layer jun 1996 SSL 3.0 Something stable! jan 1999 TLS 1.0 SSL 3.1 apr 2006 TLS 1.1 TLS 1.2 aug 2008 SSL 1.0 Vaporware 1994 7
18. https://www.trustworthyinternet.org/ssl-pulse/ 25,7% 99,6% 99,3% 18,2% 20,7% SSL 2.0 SSL 3.0 TLS 1.0 TLS 1.1 TLS 1.2 8 November 2013
19. https://www.trustworthyinternet.org/ssl-pulse/ 25,7% 99,6% 99,3% 18,2% 20,7% SSL 2.0 SSL 3.0 TLS 1.0 TLS 1.1 TLS 1.2 8 19,4% 98,0% 99,3% 42,0% 44,3% SSL 2.0 SSL 3.0 TLS 1.0 TLS 1.1 TLS 1.2 November 2013 Oct 2014
20. https://www.trustworthyinternet.org/ssl-pulse/ 25,7% 99,6% 99,3% 18,2% 20,7% SSL 2.0 SSL 3.0 TLS 1.0 TLS 1.1 TLS 1.2 8 19,4% 98,0% 99,3% 42,0% 44,3% SSL 2.0 SSL 3.0 TLS 1.0 TLS 1.1 TLS 1.2 November 2013 Oct 2014 16,6% 60,6% 99,5% 45,4% 48,1% SSL 2.0 SSL 3.0 TLS 1.0 TLS 1.1 TLS 1.2 Nov 2014
21. RFC 5246 (TLS v1.2) 9
22. 10 Record Layer
23. 10 Record Layer Type Version Length
24. 10 Record Layer Type Version Length Protocol
25. 10 Record Layer Type Version Length Protocol Protocol Protocol
26. 10 Record Layer Type Version Length Protocol Protocol Protocol Record Layer Type Version Length Protocol
27. ➡ Handshake protocol records ➡ Setup communication ➡ Change Cipher Spec protocol records ➡ Change communication ➡ Alert protocol records ➡ Errors ➡ Application Data protocol records ➡ Actual data transfers 11
28. 12 https://github.com/vincentbernat/rfc5077/blob/master/ssl-handshake.svg
29. Attention: (live) wiresharking up ahead 13
31. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 15
32. TLS ECDHE_ECDSA WITH AES_128_GCM SHA256 16
33. TLS ECDHE_ECDSA WITH AES_128_GCM SHA256 Cipher for exchanging key information 16
34. TLS ECDHE_ECDSA WITH AES_128_GCM SHA256 Cipher for exchanging key information Cipher for authenticating key information 16
35. TLS ECDHE_ECDSA WITH AES_128_GCM SHA256 Cipher for exchanging key information Cipher for authenticating key information Actual cipher (and length) used for communication 16
36. TLS ECDHE_ECDSA WITH AES_128_GCM SHA256 Cipher for exchanging key information Cipher for authenticating key information Hash algo for message authenticating Actual cipher (and length) used for communication 16
37. TLS_RSA_WITH_AES_256_CBC_SHA256 17
38. TLS_NULL_WITH_NULL_NULL 18
39. Client gives cipher options, Server ultimately decides on cipher! 19
40. THIS IS WHY YOU SHOULD ALWAYS CONFIGURE YOUR CIPHERS ON YOUR WEB SERVER! 20 Unknown fact!
41. 21 https://cipherli.st SSLCipherSuite AES256+EECDH:AES256+EDH SSLProtocol All -SSLv2 -SSLv3 SSLCompression off # Requires Apache >= 2.4 SSLHonorCipherOrder On SSLUseStapling on # Requires Apache >= 2.4 SSLStaplingCache "shmcb:logs/stapling-cache(150000)" # Requires >= Apache 2.4 Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" Header always set X-Frame-Options DENY ssl_ciphers 'AES256+EECDH:AES256+EDH'; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_session_cache builtin:1000 shared:SSL:10m; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains"; add_header X-Frame-Options DENY; ssl_stapling on; # Requires nginx >= 1.3.7 ssl_stapling_verify on; # Requires nginx => 1.3.7 resolver $DNS-IP-1 $DNS-IP-2 valid=300s; resolver_timeout 5s; Apache: nginx:
42. https://www.ssllabs.com/ssltest/ 22
45. 25 ➡ SNI (Server Name Indication) ➡ Extension 0x0000 ➡ Pretty much every decent browser / server. ➡ IE6, Win XP, Blackberry, Android 2.x, java 1.6.x ➡ So no worries!
47. What an SSL certificate is NOT: 27 ➡ SSL certificate (but a X.509 certificate) ➡ Automatically secure ➡ Automatically trustworthy ➡ In any way better self-signed certificates ➡ Cheap
48. What an SSL certificate is: 28 ➡ The best way (but not perfect) to prove authenticity ➡ A way to bootstrap encrypted communication ➡ Misleading ➡ (Too) Expensive
50. 29 ➡ X.509 Certificate
51. 29 ➡ X.509 Certificate ➡ Owner info (who is this owner)
52. 29 ➡ X.509 Certificate ➡ Owner info (who is this owner) ➡ Domain info (for which domain(s) is this certificate valid)
53. 29 ➡ X.509 Certificate ➡ Owner info (who is this owner) ➡ Domain info (for which domain(s) is this certificate valid) ➡ Expiry info (from when to when is this certificate valid)
54. 30 yourdomain.com
55. 30 yourdomain.com Intermediate CA
56. 30 yourdomain.com Intermediate CA
57. 30 yourdomain.com Root CA Intermediate CA
58. 30 yourdomain.com Root CA Intermediate CA
59. 30 yourdomain.com Root CA Intermediate CA
60. 31 IMPLIED TRU$T
61. ➡ (Root) Certificate Authorities ➡ They are built into your browser / OS and you will automatically trust them. 32
62. 33 wget http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/ckfw/builtins/certdata.txt\?raw\=1 -O - -q | grep Issuer | sort | uniq | wc -l
63. 33 wget http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/ckfw/builtins/certdata.txt\?raw\=1 -O - -q | grep Issuer | sort | uniq | wc -l 182 And rising...
65. 34 ➡ X.509 certificates are used to authenticate the server.
66. 34 ➡ X.509 certificates are used to authenticate the server. ➡ Servers can ask clients to authenticate themselves as well.
67. 34 ➡ X.509 certificates are used to authenticate the server. ➡ Servers can ask clients to authenticate themselves as well. ➡ APIs
69. 36 Generating secrets:
70. 36 pre master secret server rand client rand Generating secrets: + +
71. 36 pre master secret server rand client rand master secret Generating secrets: + +
72. 36 pre master secret server rand client rand master secret master secret server rand client rand Generating secrets: + + + +
73. 36 pre master secret server rand client rand master secret master secret server rand client rand key buffer Generating secrets: + + + +
74. 36 pre master secret server rand client rand master secret client MAC client KEY client IV server MAC server KEY server IV master secret server rand client rand key buffer Generating secrets: + + + +
75. https://github.com/jaytaph/TLS-decoder 37 http://www.adayinthelifeof.nl/2013/12/30/decoding-tls-with-php/ Try it yourself, php style:
79. 41 Wireshark CAN decrypt your HTTPS traffic Unknown fact! SSLKEYLOGFILE https://isc.sans.edu/forums/diary/Psst+Your+Browser+Knows+All+Your+Secrets+/16415
80. 42 launchctl setenv SSLKEYLOGFILE /tmp/keylog.secret on a mac:
81. ➡ TLS has overhead in computation and transfers. But definitely worth it. ➡ Google likes it. ➡ Some ciphersuites are better, but slower. ➡ Speed / Security compromise ➡ (try: “openssl speed”) 43
82. Are we safe yet? 44
83. euh,.. no :/ 45
84. 46 PRE MASTER SECRET
85. What if somebody* got hold of the site private key? 47
90. (PERFECT) FORWARDING SECRECY 52
91. Compromising the pre-master secret does not compromise our communication. 53
92. PFS: Can’t compromise other keys with a compromised key. 54
93. Unfortunately.. 55
94. 56 PFS needs server AND browser support
95. 57 http://news.netcraft.com/archives/2013/06/25/ssl-intercepted-today-decrypted-tomorrow.html
96. 58 http://news.netcraft.com/archives/2013/06/25/ssl-intercepted-today-decrypted-tomorrow.html
97. Update your cipher suite list and place PFS ciphers at the top 59
98. But beware: heavy computations 60
99. 61 SSL Test https://www.ssllabs.com/ssltest/
100. -ETOOMUCHINFO 62
101. 63 https://www.ssllabs.com/projects/best-practices/index.html
102. http://farm1.static.flickr.com/73/163450213_18478d3aa6_d.jpg 64
103. 65 Find me on twitter: @jaytaph Find me for development and training: www.noxlogic.nl Find me on email: jthijssen@noxlogic.nl Find me for blogs: www.adayinthelifeof.nl