and x509 An introduction to TLS, PKI2016 05 09 - #PyCon.SE...

www.modio.se2016 05 09 - #PyCon.SE

An introduction to TLS, PKI and x509

The cost of legacy

“Release Dictator”

D.S. LjungmarkModio ABhttps://twitter.com/spidlerhttps://github.com/Spindel/

IntroductionsSystems nerd

Security fellowFree Software Fan

Opinionated UnixbeardSocial Justice Aficionado

Slides

https://www.modio.se/pages/presentations.html

TLS is a collection of

ciphers, hashes

MACS, curves

algorithms, certificates

negotiations, extensions

exchange formats

SSLv2 (not standard)

● The first SSL from 1995

the year after Python 1.0

● Deprecated for 20 years

SSLv3 (not standard)

● Released in 1996

the year before Python 1.5

● Deprecated for 17 years

The Crypto Wars

● Munitions● Export restrictions● Weakened crypto

TLS v1.0: The first standard

● Pre-dating Python 2.0

● No export crypto

TLS v1.1

● Before Python 2.4

TLS v1.2 ( Current day )

● Same year as Python 2.5

● Extension support

Cracks in the shell

RFC 7457

CRIME, BREACH

POODLE (SSLv3)

Logjam, FREAK

MD5, SHA1

Cleaning out......or not

● SSLv2 shot in the neck (2016)

● SSLv3 taken out back (2016)

● TLSv1.0, with broken parts, still alive

● TLSv1.1, with broken parts, same

The future: TLSv1.3( not released )

Fixing security

Removes broken… “stuff”

Limits compatibility

TLS is not enough…

● DUAL EC DRBG

● More bans on crypto

www.modio.se2016 05 09 - #PyCon.SE...but it is such a perfect place to start

The problem is key distribution

● Walk to your bank● Leap of Faith

(Trust on first sight)

● The web of Trust (GPG)

Relevant PKI Models

● Trust the Government● Pay for trust● Assume tech is fair● Trust something else

x509 certificates

1. Imagine JSON2. With types and tags3. from the 80’s

Certificate contents

Signature paths

Issuer

Server

How PKI works (theory)

1. Vendor distributes CA collection to client2. Server distributes cert and intermediate

3. Client validates the collection

The weakness of PKI

● Paid trust● Mispaid trust● Too big to fail● Forced trust

PKI: Too big to fail

Symantec

Türktrust

DigiNotar

PKI: Forced trust

● Employers● Remote admin apps● Governments*

(*Kazakhstan)

Domain Validationvs.

Extended Validation

Verification is hard

Randall Munroe, https://xkcd.com/1181/

The most common failures

“Yey, I got a cert!”

Python 2.7.6

“I didn’t bother to check the signature”

Python, again

“I didn’t bother to check the expiration date”

Python, once more

“I didn’t bother to check the domain name”

It’s tedious now

Deprecation, nigh impossible

SHA1 deprecation has failed

MD5 deprecation almost failed

RC4 is still around

TLS: The defaults suckssl_certificate /etc/letsencrypt/live/do01.skuggor.se/fullchain.pem;

ssl_certificate_key /etc/letsencrypt/live/do01.skuggor.se/privkey.pem;

ssl_session_timeout 1d;

ssl_session_cache shared:SSL:50m;

ssl_session_tickets off;

ssl_dhparam /etc/ssl/private/2048.pem;

ssl_protocols TLSv1.2;

ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

ssl_prefer_server_ciphers on;

add_header Strict-Transport-Security max-age=15768000;

ssl_stapling on;

ssl_stapling_verify on;

ssl_trusted_certificate /etc/letsencrypt/live/do01.skuggor.se/fullchain.pem;

resolver 8.8.8.8;

TLS: The defaults suck

SSLContext - Broken defaults

use create_default_context() factory!

Vendors shipping broken tools

OS X: Deprecated OpenSSL

OS X: ships OpenSSL 0.9.8

Python: Bundles outdated OpenSSL

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DH-DSS-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DH-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DH-RSA-AES256-SHA256:DH-DSS-

AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DH-RSA-AES256-SHA:DH-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:DH-RSA-CAMELLIA256-SHA:DH-DSS-

CAMELLIA256-SHA:AECDH-AES256-SHA:ADH-AES256-GCM-SHA384:ADH-AES256-SHA256:ADH-AES256-SHA:ADH-CAMELLIA256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:PSK-AES256-CBC-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DH-DSS-AES128-GCM-

SHA256:DHE-DSS-AES128-GCM-SHA256:DH-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DH-RSA-AES128-SHA256:DH-DSS-AES128-

SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DH-RSA-AES128-SHA:DH-DSS-AES128-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:DH-RSA-CAMELLIA128-SHA:DH-DSS-

CAMELLIA128-SHA:AECDH-AES128-SHA:ADH-AES128-GCM-SHA256:ADH-AES128-SHA256:ADH-AES128-SHA:ADH-CAMELLIA128-SHA:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128-SHA256:ECDH-RSA-AES128-SHA:ECDH-ECDSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA:PSK-AES128-CBC-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DH-RSA-DES-CBC3-SHA:DH-DSS-DES-CBC3-SHA:AECDH-DES-CBC3-SHA:ADH-DES-CBC3-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-ECDSA-DES-CBC3-SHA:DES-CBC3-SHA:PSK-3DES-EDE-CBC-SHA:KRB5-DES-CBC3-SHA:KRB5-DES-CBC3-MD5:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DH-RSA-SEED-SHA:DH-DSS-SEED-SHA:ADH-SEED-SHA:SEED-SHA:IDEA-CBC-SHA:KRB5-IDEA-CBC-SHA:KRB5-IDEA-CBC-MD5:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AECDH-RC4-SHA:ADH-RC4-MD5:ECDH-RSA-RC4-SHA:ECDH-ECDSA-RC4-SHA:RC4-SHA:RC4-MD5:PSK-RC4-SHA:KRB5-RC4-SHA:KRB5-RC4-MD5:ECDHE-RSA-NULL-SHA:ECDHE-ECDSA-NULL-SHA:AECDH-NULL-SHA:ECDH-RSA-NULL-SHA:ECDH-ECDSA-NULL-SHA:NULL-

SHA256:NULL-SHA:NULL-MD5

Picking a cipher

ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256

Legacy: The old configuration

PROTOCOL.SSLv23(deprecated)

+ OP.NO_SSLv2

+ OP.NO_SSLv3 vs.

PROTOCOL.TLS

Documentation never dies

ssl.wrap_socket()ctx = ssl.create_default_context()

ctx.options |= ssl.OP_NO_TLSv1

ctx.options |= ssl.OP_NO_TLSv1_1

ctx.wrap_socket()

Upgrading is hard

Python 2.7 is the Windows XP of programming languages

The cost of compatibility

Supporting TLS 1.0 in a new service?

- Do you also run it on Python 1.6?

The Fixes

Configuration:

- Mozilla SSL configurator tool

Documentation:

- …no easy fixes

Let’s Encrypt

- Trust the machine

Let’s Encrypt!

$ apt-get install letsencrypt

$ letsencrypt certonly -d example.com

Let’s Encrypt!import cherrypy

class HelloWorld(object):@cherrypy.exposedef index(self):

return "Hello world!"

if __name__ == '__main__':server_config={

'server.socket_host': '0.0.0.0', 'server.socket_port': 443,'server.ssl_module': 'builtin',

'server.ssl_certificate': '/etc/letsencrypt/live/do01.skuggor.se/fullchain.pem', 'server.ssl_private_key': '/etc/letsencrypt/live/do01.skuggor.se/privkey.pem', 'server.ssl_certificate_chain': '/etc/letsencrypt/live/do01.skuggor.se/fullchain.pem',

}cherrypy.config.update(server_config)cherrypy.quickstart(HelloWorld())

CherryPy, Ubuntu 16.04

That’s it for now

Thank You!

Tomorrow, 15:00“Eliminating application passwords using TLS”

Slides

https://www.modio.se/pages/presentations.html

and x509 An introduction to TLS, PKI2016 05 09 - #PyCon.SE...

Documents

Transcript of and x509 An introduction to TLS, PKI2016 05 09 - #PyCon.SE...

Secure Two-party Threshold ECDSA from ECDSA …2) We present an efﬁcient two-party, two-round ECDSA signing protocol that is secure under the Computational Difﬁe-Hellman assumption

Low-Latency ECDSA Signature Veri cation { A Road Towards … · 2014-10-20 · Low-Latency ECDSA Signature Veri cation { A Road Towards Safer Tra c {Miroslav Kne zevi c, Ventzislav

E cient and Secure ECDSA Algorithm and its …1 E cient and Secure ECDSA Algorithm and its Applications: A Survey Mishall Al-Zubaidie1,2, Zhongwei Zhang2 and Ji Zhang2 1Thi-Qar University,

Fast Multiparty Threshold ECDSA with Fast Trustless Setup · Fast Multiparty Threshold ECDSA with Fast Trustless Setup Rosario Gennaro1 and Steven Goldfeder2 1 City University of

Introductiondownload.microsoft.com/download/B/E/3/BE365594-D… · Web viewManage-bde –on : -tpmandpin -encryptionMethod aes256 Administrators

Batch Verification of ECDSA Signatures AfricaCrypt … ECDSA Algorithm A Naive Algorithm for ECDSA Batch Veri cation A New Batch-veri cation Algorithm for ECDSA (S1) A More E cient

Cryptography for Blockchains beyond ECDSA and … · Overview 1.Signatures 1.ECDSA 2.BLS 3.Threshold Signatures 4.Ring Signatures 5.Blind Signatures 2.Zero-Knowledge Proofs 1.An illustrative

Bitcoin Storage Security Survey: Wallets Cold Storage BIP032nicolascourtois.com/bitcoin/paycoin_secure_storage_3bef.pdfCryptographic Security of ECDSA in Bitcoin 48 Nicolas T. Courtois

Introduction to Bitcoin and ECDSA

LadderLeak Breaking ECDSA with Less than One Bit of Nonce ...

UML BASED MODELING OF ECDSA FOR SECURED AND SMART E-GOVERNANCE SYSTEM

PS3 Security Julian Wechsler. Overview Legal Issues DMCA Security Overview Exploits Geohots Exploit, PS Jailbreak Flaws ECDSA.

Services absichern - Common Practice · SMTP PostfixCipherList tls_preempt_cipherlist = yes tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:\ EECDH+aRSA+AESGCM: EECDH+aRSA+SHA384: \ EECDH+aRSA+SHA256:EECDH

Standards and Specifications - egovstandards.gov.inegovstandards.gov.in/sites/default/files/Standards and... · Standards and Specifications For ... ECDSA Elliptic Curve Digital Signature

Fast Threshold ECDSA with Honest MajorityFast Threshold ECDSA with Honest Majority 3 i.e., after the message to be signed is known. Contrary to this, our protocol allows the parties

The Implementation and Analysis of the ECDSA on the ...cgebotys/NEW/ERIC_Masters.pdf · ECDSA on the Motorola StarCore SC140 DSP Primarily Targeting Portable Devices by Eric W. Smith

ArubaOS 6.1 Command Line Interface - Airheads … · esp-aes128-gcm |esp-aes256-gcm This command configures IPsec parameters. ... ArubaOS 6.1 Command Line Interface | Reference Guide

Side-Channel Attack on OpenSSL ECDSA

Compatibility Matrix for Cisco Unified Communications ... › c › en › us › td › docs › voice_ip... · ciscocertificate tcp/tls 3804 authorityproxy function ecdhe-rsa-aes256-gcm-sha384:

Deploying New DNSSEC Algorithms - ICANN€¦ · 12 GOST R 34.10-2001 ECC-GOST 13 ECDSA Curve P-256 wSHA-256 ECDSAP256SHA256 14 ECDSA Curve P-384 wSHA-384 ECDSAP384SHA384 15-122 Unassigned