Pro Yearly is on sale from $80 to $50! »

The first few milliseconds of HTTPS - phpnz14

1761ecd7fe763583553dde43e62c47bd?s=47 Joshua Thijssen
August 28, 2014
110

The first few milliseconds of HTTPS - phpnz14

1761ecd7fe763583553dde43e62c47bd?s=128

Joshua Thijssen

August 28, 2014
Tweet

Transcript

  1. The first 200 milliseconds of HTTPS 1 Joshua Thijssen jaytaph

  2. 2

  3. ➡ What’s happening in the first 200+ milliseconds in a

    initial HTTPS connection. 2
  4. ➡ What’s happening in the first 200+ milliseconds in a

    initial HTTPS connection. ➡ Give tips and hints on hardening your setup. 2
  5. ➡ What’s happening in the first 200+ milliseconds in a

    initial HTTPS connection. ➡ Give tips and hints on hardening your setup. ➡ Give you insights in new and upcoming technologies. 2
  6. ➡ What’s happening in the first 200+ milliseconds in a

    initial HTTPS connection. ➡ Give tips and hints on hardening your setup. ➡ Give you insights in new and upcoming technologies. ➡ Show you things to you (probably) didn’t knew. 2
  7. This talk is inspired by a blogpost from Jeff Moser

    http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html Unknown fact! 3
  8. HTTPS == HTTP on top of TLS 4

  9. Transport Layer Security (TLS) 5

  10. Secure Socket Layer (SSL) 6 A short and scary history

  11. then now 7

  12. then now SSL 1.0 Vaporware 1994 7

  13. then now feb 1995 SSL 2.0 Not-so-secure-socket-layer SSL 1.0 Vaporware

    1994 7
  14. then now feb 1995 SSL 2.0 Not-so-secure-socket-layer jun 1996 SSL

    3.0 Something stable! SSL 1.0 Vaporware 1994 7
  15. then now feb 1995 SSL 2.0 Not-so-secure-socket-layer jun 1996 SSL

    3.0 Something stable! jan 1999 TLS 1.0 SSL 3.1 SSL 1.0 Vaporware 1994 7
  16. then now feb 1995 SSL 2.0 Not-so-secure-socket-layer jun 1996 SSL

    3.0 Something stable! jan 1999 TLS 1.0 SSL 3.1 apr 2006 TLS 1.1 SSL 1.0 Vaporware 1994 7
  17. then now feb 1995 SSL 2.0 Not-so-secure-socket-layer jun 1996 SSL

    3.0 Something stable! jan 1999 TLS 1.0 SSL 3.1 apr 2006 TLS 1.1 TLS 1.2 aug 2008 SSL 1.0 Vaporware 1994 7
  18. https://www.trustworthyinternet.org/ssl-pulse/ 25,7% 99,6% 99,3% 18,2% 20,7% SSL 2.0 SSL 3.0

    TLS 1.0 TLS 1.1 TLS 1.2 8 November 2013
  19. https://www.trustworthyinternet.org/ssl-pulse/ 25,7% 99,6% 99,3% 18,2% 20,7% SSL 2.0 SSL 3.0

    TLS 1.0 TLS 1.1 TLS 1.2 8 20,5% 98,5% 99,3% 38,4% 40,8% SSL 2.0 SSL 3.0 TLS 1.0 TLS 1.1 TLS 1.2 November 2013 Aug 2014
  20. RFC 5246 (TLS v1.2) 9

  21. 10 Record Layer

  22. 10 Record Layer Type Version Length

  23. 10 Record Layer Type Version Length Protocol

  24. 10 Record Layer Type Version Length Protocol Protocol Protocol

  25. 10 Record Layer Type Version Length Protocol Protocol Protocol Record

    Layer Type Version Length Protocol
  26. ➡ Handshake protocol records ➡ Setup communication ➡ Change Cipher

    Spec protocol records ➡ Change communication ➡ Alert protocol records ➡ Errors ➡ Application Data protocol records ➡ Actual data transfers 11
  27. 12 https://github.com/vincentbernat/rfc5077/blob/master/ssl-handshake.svg

  28. Attention: (live) wiresharking up ahead 13

  29. 14

  30. 15

  31. Generating randomness is HARD 16

  32. entropy (uncertainty) 17

  33. TIME is NOT random thus not a very good entropy

    source 18
  34. PHP is bad when it comes to entropy 19 Unknown

    fact!
  35. srand(microtime()) 20 Unknown fact!

  36. rand() mt_rand() uniqid() 21

  37. 22

  38. openssl_pseudo_random_bytes() 22

  39. openssl_pseudo_random_bytes() read from /dev/(u)random 22

  40. openssl_pseudo_random_bytes() read from /dev/(u)random Use a HRNG 22

  41. openssl_pseudo_random_bytes() read from /dev/(u)random Use a HRNG “A million random

    digits” 22
  42. openssl_pseudo_random_bytes() read from /dev/(u)random Use a HRNG “A million random

    digits” https://github.com/ircmaxell/RandomLib 22
  43. 23

  44. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 24

  45. TLS ECDHE_ECDSA WITH AES_128_GCM SHA256 25

  46. TLS ECDHE_ECDSA WITH AES_128_GCM SHA256 Cipher for exchanging key information

    25
  47. TLS ECDHE_ECDSA WITH AES_128_GCM SHA256 Cipher for exchanging key information

    Cipher for authenticating key information 25
  48. TLS ECDHE_ECDSA WITH AES_128_GCM SHA256 Cipher for exchanging key information

    Cipher for authenticating key information Actual cipher (and length) used for communication 25
  49. TLS ECDHE_ECDSA WITH AES_128_GCM SHA256 Cipher for exchanging key information

    Cipher for authenticating key information Hash algo for message authenticating Actual cipher (and length) used for communication 25
  50. TLS_RSA_WITH_AES_256_CBC_SHA256 26

  51. TLS_NULL_WITH_NULL_NULL 27

  52. Client gives cipher options, Server ultimately decides on cipher! 28

  53. THIS IS WHY YOU SHOULD ALWAYS CONFIGURE YOUR CIPHERS ON

    YOUR WEB SERVER! 29 Unknown fact!
  54. SSLProtocol all -SSLv2 -SSLv3 SSLHonorCipherOrder on SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384

    \ EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \ EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS" ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \ EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \ EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"; Apache Nginx 30 https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy
  55. https://www.ssllabs.com/ssltest/ 31

  56. 32

  57. 33

  58. 34

  59. 35

  60. 36

  61. 37

  62. 38 New Zealand,

  63. 39

  64. 40 ➡ SNI (Server Name Indication) ➡ Extension 0x0000 ➡

    Pretty much every decent browser / server. ➡ IE6, Win XP, Blackberry, Android 2.x ➡ So no worries!
  65. 41

  66. 42

  67. What an SSL certificate is NOT: 43 ➡ SSL certificate

    (but a X.509 certificate) ➡ Automatically secure ➡ Automatically trustworthy ➡ In any way better self-signed certificates ➡ Cheap
  68. What an SSL certificate is: 44 ➡ The best way

    (but not perfect) to prove authenticity ➡ A way to bootstrap encrypted communication ➡ Misleading ➡ (Too) Expensive
  69. 45

  70. 45 ➡ X.509 Certificate

  71. 45 ➡ X.509 Certificate ➡ Owner info (who is this

    owner)
  72. 45 ➡ X.509 Certificate ➡ Owner info (who is this

    owner) ➡ Domain info (for which domain(s) is this certificate valid)
  73. 45 ➡ X.509 Certificate ➡ Owner info (who is this

    owner) ➡ Domain info (for which domain(s) is this certificate valid) ➡ Expiry info (from when to when is this certificate valid)
  74. 46 yourdomain.com

  75. 46 yourdomain.com Intermediate CA

  76. 46 yourdomain.com Intermediate CA

  77. 46 yourdomain.com Root CA Intermediate CA

  78. 46 yourdomain.com Root CA Intermediate CA

  79. 46 yourdomain.com Root CA Intermediate CA

  80. 47 IMPLIED TRU$T

  81. ➡ (Root) Certificate Authorities ➡ They are built into your

    browser / OS and you will automatically trust them. 48
  82. 49 wget http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/ckfw/builtins/certdata.txt\?raw\=1 -O - -q | grep Issuer |

    sort | uniq | wc -l
  83. 49 wget http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/ckfw/builtins/certdata.txt\?raw\=1 -O - -q | grep Issuer |

    sort | uniq | wc -l 181 And rising...
  84. 50

  85. 50 ➡ X.509 certificates are used to authenticate the server.

  86. 50 ➡ X.509 certificates are used to authenticate the server.

    ➡ Servers can ask clients to authenticate themselves as well.
  87. 50 ➡ X.509 certificates are used to authenticate the server.

    ➡ Servers can ask clients to authenticate themselves as well. ➡ APIs
  88. 51

  89. 52

  90. 53 Generating secrets:

  91. 53 pre master secret server rand client rand Generating secrets:

    + +
  92. 53 pre master secret server rand client rand master secret

    Generating secrets: + +
  93. 53 pre master secret server rand client rand master secret

    master secret server rand client rand Generating secrets: + + + +
  94. 53 pre master secret server rand client rand master secret

    master secret server rand client rand key buffer Generating secrets: + + + +
  95. 53 pre master secret server rand client rand master secret

    client MAC client KEY client IV server MAC server KEY server IV master secret server rand client rand key buffer Generating secrets: + + + +
  96. https://github.com/jaytaph/TLS-decoder 54 http://www.adayinthelifeof.nl/2013/12/30/decoding-tls-with-php/ Try it yourself, php style:

  97. 55

  98. 56

  99. 57

  100. 58

  101. 59 Wireshark CAN decrypt your HTTPS traffic Unknown fact! SSLKEYLOGFILE

    https://isc.sans.edu/forums/diary/Psst+Your+Browser+Knows+All+Your+Secrets+/16415
  102. 60 launchctl setenv SSLKEYLOGFILE /tmp/keylog.secret on a mac:

  103. 61

  104. ➡ TLS has overhead in computation and transfers. But definitely

    worth it. ➡ Google likes it. ➡ Some ciphersuites are better, but slower. ➡ Speed / Security compromise ➡ (try: “openssl speed”) 62
  105. Are we safe yet? 63

  106. euh,.. no :/ 64

  107. 65 PRE MASTER SECRET

  108. What if somebody* got hold of the site private key?

    66
  109. 67

  110. 68

  111. 69

  112. 70

  113. (PERFECT) FORWARDING SECRECY 71

  114. Compromising the pre-master secret does not compromise our communication. 72

  115. PFS: Can’t compromise other keys with a compromised key. 73

  116. Unfortunately.. 74

  117. 75 PFS needs server AND browser support

  118. 76 http://news.netcraft.com/archives/2013/06/25/ssl-intercepted-today-decrypted-tomorrow.html

  119. 77 http://news.netcraft.com/archives/2013/06/25/ssl-intercepted-today-decrypted-tomorrow.html

  120. Update your cipher suite list and place PFS ciphers at

    the top 78
  121. But beware: heavy computations 79

  122. 80 SSL Test https://www.ssllabs.com/ssltest/

  123. -ETOOMUCHINFO 81

  124. 82 https://www.ssllabs.com/projects/best-practices/index.html

  125. http://farm1.static.flickr.com/73/163450213_18478d3aa6_d.jpg 83

  126. 84 Find me on twitter: @jaytaph Find me for development

    and training: www.noxlogic.nl Find me on email: jthijssen@noxlogic.nl Find me for blogs: www.adayinthelifeof.nl