Work

On the security of TLS renegotiation

Year: 2013

Type: conference-paper

Abstract: The Transport Layer Security (TLS) protocol is the most widely used security protocol on the Internet. It supports negotiation of a wide variety of cryptographic primitives through different cipher suites, various modes of client authentication, and additional features such as renegotiation. Despite its widespread use, only recently has the full TLS protocol been proven secure, and only the core cryptographic protocol with no additional features. These additional features have been the cause of several practical attacks on TLS. In 2009, Ray and Dispensa demonstrated how TLS renegotiation allows an attacker to splice together its own session with that of a victim, resulting in a man-in-the-middle attack on TLS-reliant applications such as HTTP. TLS was subsequently patched with two defence mechanisms for protection against this attack.

Source: ACM SIGSAC Conference on Computer and Communications Security (CCS)

DOI: 10.1145/2508859.2516694

Authors: Florian Giesen, Florian Kohlar, Douglas Stebila

Institutions: Ruhr University Bochum, Queensland University of Technology

Language: English

Topic: Advanced Authentication Protocols Security

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

Funder: Deutscher Akademischer Austauschdienst

Award: G3696053436