Coming of Age

Abstract

The Transport Layer Security (TLS) protocol is the de-facto standard for encrypted communication on the Internet. However, it has been plagued by a number of different attacks and security issues over the last years. Addressing these attacks requires changes to the protocol, to server-or client-software, or to all of them. In this paper we conduct the first large-scale longitudinal study examining the evolution of the TLS ecosystem over the last six years. We place a special focus on the ecosystem's evolution in response to high-profile attacks. For our analysis, we use a passive measurement dataset with more than 319.3B connections since February 2012, and an active dataset that contains TLS and SSL scans of the entire IPv4 address space since August 2015. To identify the evolution of specific clients we also create the-to our knowledge-largest TLS client fingerprint database to date, consisting of 1,684 fingerprints. We observe that the ecosystem has shifted significantly since 2012, with major changes in which cipher suites and TLS extensions are offered by clients and accepted by servers having taken place. Where possible, we correlate these with the timing of specific attacks on TLS. At the same time, our results show that while clients, especially browsers, are quick to adopt new algorithms, they are also slow to drop support for older ones. We also encounter significant amounts of client software that probably unwittingly offer unsafe ciphers. We discuss these findings in the context of long tail effects in the TLS ecosystem.

The Reality of Algorithm Agility

“…We carry out additional active measurements, providing a new perspective on algorithm deployment. Thereby, our paper has a similar focus as work by Kotzias et al [41]. They show how TLS deployments and cipher suites have changed over several years.…”

The Security State of the German Health Web: An Exploratory Study

“…Figure 1 depicts the system's workflow for the scanning and analysis process. For this study, we obtained the URLs of the 1,000 top-ranked health-related web sites (according to PageRank) for each of the country-code top level domains: ".de", ".at" and ".ch" from a crawl of the GHW conducted in 2020 [6]. The PageRank was computed on the graph representation of the GHW.…”

“…The PageRank was computed on the graph representation of the GHW. The methodology used to obtain the GHW graph is described in detail in [6].…”

“…Duly deployed and accompanied with the usage of HTTP security headers [5], an adequate level of security may be achieved. While large-scale analyses of SSL/TLS deployments have already been made [6,7], to the best of the authors' knowledge, no study has been published about the security of the health-related web. We provide a first analysis of the SSL/TLS security of and the security headers used within the health-related web limited to web pages in German, the German health web (GHW) [8].…”

Hammurabi

“…Measurements. There is a long thread of studies examining the web's certificate ecosystem from various vantage points [50,51,62,63,71,94,107,120]. Studies have specifically examined the cost of HTTPS [91]; how certificates are managed from the web administrator side [29,36,127], the CA side [73], within root stores [84,119], and by CDNs [29,80]; and the response to specific security vulnerabilities [126] like Heartbleed [49,127].…”