This report analyses the security of older TLS versions by illustrating a taxonomy of attacks and explaining technical details on the BEAST and Lucky Thirteen attack. The fundamentals of TLS are based on the TLS 1.2 standard. Furthermore, the advantages of a migration to TLS 1.3 are highlighted.
The internet has become part of our daily lives. When the internet was originally designed, no one was considering the potential threats it might behold. Today, all devices connected to the internet have one thing in common - they rely on secure protocols to protect the information in transit. This is where Secure Socket Layer (SSL) and Transport Layer Security (TLS) come into play.
The Transport Layer Security protocol quickly became dominant for use in applications and servers for transferring data across the internet in a secure manner. One way to recognize a secure website is the usage of Hypertext Transfer Protocol Secure (HTTPS). The “S” in HTTPS stands for “Secure” and is an easy characteristic to identify secure website connections.
Furthermore, to highlight to a client that TLS is used to protect HTTP, the server may replace the protocol naming in the URL with https and add a lock symbol or even a coloured address bar. Besides, the Google Chrome Web browser has started flagging all unencrypted HTTP sites as "not secure" Moreover, Google is penalizing websites which are not protected.
The TLS Protocol is widely used for providing internet security. The protocol has been subject to several version upgrades over the course of its 25-year lifespan. Although TLS 1.3 is the latest version, its predecessor TLS 1.2 is most widely supported by websites. The versions minor to TLS 1.3 have several vulnerabilities which have been exploited in attacks like POODLE, BEAST etc.
Inhaltsverzeichnis (Table of Contents)
- Introduction
- Motivation
- Research Objective
- Structure of this report
- Fundamentals of SSL/TLS and DTLS
- Introduction
- SSL/TLS
- TLS Record Protocol
- TLS Handshake Protocol
- DTLS
- DTLS Record Protocol
- DTLS Handshake Protocol
- Summary
- Attacks on SSL/TLS and DTLS
- Introduction
- BEAST Attack
- How the Attack Works
- Mitigation
- Lucky Thirteen Attack
- How the Attack Works
- Padding Oracle Attack
- Mitigation
- TLS 1.3
- Introduction
- TLS Handshake Protocol
- Summary
- Conclusions
Zielsetzung und Themenschwerpunkte (Objectives and Key Themes)
This report aims to analyze the security of older TLS versions, particularly TLS 1.2 and prior, which are widely supported by websites, and highlight the advantages of migrating to TLS 1.3.
- Security of TLS versions prior to TLS 1.3
- Vulnerabilities in older TLS versions
- Attacks against SSL/TLS and DTLS
- Advantages of migrating to TLS 1.3
- Improvements in TLS 1.3
Zusammenfassung der Kapitel (Chapter Summaries)
- Introduction: Provides context and motivation for the research, highlighting the increasing importance of internet security due to rising cybercrime and internet usage.
- Fundamentals of SSL/TLS and DTLS: Introduces the basics of the TLS and DTLS protocols, including the record and handshake protocols, and compares their functionalities.
- Attacks on SSL/TLS and DTLS: Presents a taxonomy of attacks targeting SSL/TLS, with a detailed examination of the BEAST and Lucky Thirteen attacks, explaining their mechanisms and mitigations.
- TLS 1.3: Explores the features and advantages of TLS 1.3, highlighting its security improvements and performance enhancements compared to previous TLS versions.
Schlüsselwörter (Keywords)
Key terms and concepts explored in this report include: Transport Layer Security (TLS), Secure Socket Layer (SSL), Datagram Transport Layer Security (DTLS), cryptography, encryption, authentication, security vulnerabilities, attacks, BEAST, Lucky Thirteen, Padding Oracle Attack, TLS 1.3, AEAD, Perfect Forward Secrecy (PFS), handshake protocol, record protocol.
- Quote paper
- Sarah Syed-Winkler (Author), 2021, On the security of TLS 1.2 and TLS 1.3. A comparison, Munich, GRIN Verlag, https://www.grin.com/document/1037281
