Transport Layer Security Handshake Protocol Research Articles

Exploiting Dissent: Towards Fuzzing-Based Differential Black-Box Testing of TLS Implementations

The Transport Layer Security (TLS) protocol is one of the most widely used security protocols on the internet. Yet do implementations of TLS keep on suffering from bugs and security vulnerabilities. In large part is this due to the protocol's complexity which makes implementing and testing TLS notoriously difficult. In this paper, we present our work on using differential testing as effective means to detect issues in black-box implementations of the TLS handshake protocol. We introduce a novel fuzzing algorithm for generating large and diverse corpuses of mostly-valid TLS handshake messages. Stimulating TLS servers when expecting a ClientHello message, we find messages generated with our algorithm to induce more response discrepancies and to achieve a higher code coverage than those generated with American Fuzzy Lop, TLS-Attacker, or NEZHA. In particular, we apply our approach to OpenSSL, BoringSSL, WolfSSL, mbedTLS, and MatrixSSL, and find several real implementation bugs; among them a serious vulnerability in MatrixSSL 3.8.4. Besides do our findings point to imprecision in the TLS specification. We see our approach as presented in this paper as the first step towards fully interactive differential testing of black-box TLS protocol implementations. Our software tools are publicly available as open source projects.

A Handshake Protocol With Unbalanced Cost for Wireless Updating

Wireless updating is an essential method to update system files or fix bugs in Internet of Things (IoT) devices. A significant and challenging problem in wireless updating is security. First, without security guarantees, attackers can utilize the updating procedure to install harmful programs into the victim devices. Second, it is challenging to provide security for wireless updating, since in many IoT scenarios, the devices to be updated are computationally limited devices and located far from the center that issues update files. Currently, there are two types of solution to protect the wireless updating. The first one is the transport layer security (TLS) protocol or secure sockets layer (SSL) protocol that are used by wireless updating schemes for mobile terminals with the following operation systems: Windows, Debian, Android, and iOS. Another solution is the elliptic curve Diffie–Hellman (ECDH)-based handshake in the software-defined function (SDF) wireless updating scheme for the IoT devices. However, both the two solutions require equal computation tasks on the update file issuing center and the device to be updated. Normally, the former is much powerful than the latter. Therefore, to further address the security problem in wireless updating, we propose a novel solution with unbalanced computation costs on the two parties. In particular, we design an improved ECDH-based handshake protocol for the SDF wireless updating scheme, namely, the unbalanced OpenFunction handshake protocol. The protocol transfers significant computation task from the limited IoT device to the powerful center. The security of the protocol is analyzed. A prototype is realized to test the performance of the protocol. The experiment results show that in the same experimental platform, our protocol is much lightweight than the TLS handshake protocol and SSL handshake protocol.

Authenticated Confidential Channel Establishment and the Security of TLS-DHE

Transport Layer Security (TLS) is the most important cryptographic protocol in use today. However, finding a cryptographic security proof for the complete, unaltered protocol has proven to be a challenging task. We give the first such proof in the standard model for the core cryptographic protocol underlying TLS cipher suites based on ephemeral Diffie–Hellman key exchange (TLS-DHE). This includes the cipher suite TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, which is mandatory in TLS 1.0 and TLS 1.1. It is impossible to prove the TLS Handshake secure in the classical security models of Bellare–Rogaway and Canetti–Krawczyk. The reason for this is that the final Finished messages of the TLS Handshake are encrypted with the session key, which provides an opportunity to distinguish real keys from random values. Therefore we start with proving the security of a truncated version of the TLS Handshake protocol, which has also been considered in previous work on TLS, and give the first proof of this variant in the standard model. Then we define the new notion of authenticated and confidential channel establishment (ACCE), which allows the monolithic analysis of protocols for which a modular security proof is not possible. We show that the combination of the TLS-DHE Handshake protocol and the TLS Record Layer encryption is secure in this model. Since the conference publication of this paper, the notion of ACCE has found many further applications, for example to the analysis of further TLS cipher suites (Krawczyk et al., Crypto 2013; Li et al., PKC 2014), advanced mechanisms like secure renegotiation of TLS session keys (Giesen et al., CCS 2013), and other practical protocols like EMV channel establishment (Brzuska et al., CCS 2013), SSH (Bergsma et al., CCS 2014), and QUIC (Lychev et al., S&P 2015).

Design and analysis of IBC-based TLS handshake protocol

To overcome the disadvantages of complex certificate management and long handshake latency which exist in current widely-used Transport Layer Security(TLS) protocol,two improved handshake protocols using identity-based cryptography were designed.One protocol adopted identity-based encryption scheme,and the other used identity-based authenticated key agreement scheme fit for mutual authentication.Results of security analysis and performance simulation show that IBC-based protocol has commensurate cryptographic computation overhead compared with certificate-based scheme with equivalent security,but it decreases communication overhead,and has prominent superiority in handshake latency;therefore,the scheme achieves higher efficiency.

Parameter Optimization-Based Batching TLS Protocol

The primary goal of the Transport Layer Security (TLS) protocol is to provide confidentiality and data integrity between two communicating entities. Since the most computationally expensive step in the TLS handshake protocol is the server’s RSA decryption, it is introduced that optimal batch RSA can be used to speedup TLS session initialization. This paper first indicates that the previous batch method is impractical since it requires a multiple of certificates, then it proposes the unique certificate scheme to overcome the problem. It is also introduced that the batching parameter is optimized when integrating users’ requirements for Internet Quality of Service (QoS). To select the optimal batching parameters, not only the server’s performance but also the client’s tolerable waiting time is considered. Based on the analysis of the mean queue time, batching service time and the stability of the system, a novel batch optimal scheduling algorithm which is deployed in a batching Web server is proposed. Finally, the proposed algorithm is evaluated to be practical and efficient through both analysis and simulation studies.