Deprecating TLS 1.0 and TLS 1.1

Moriarty, Kathleen; Farrell, Stephen

doi:10.17487/rfc8996

Cited by 21 publications

(17 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Since (D)TLS is only secure when configured correctly, we assess whether operators set parameters of the (D)TLS deployments sufficiently for secure communication. To this end, we use official guidelines listing adequate TLS versions [28,68] and cipher suites [89]. deprecated and insecure due to their reliance on SHA1 [68,90].…”

Section: Tls Foundationsmentioning

confidence: 99%

See 1 more Smart Citation

Missed Opportunities: Measuring the Untapped TLS Support in the Industrial Internet of Things

Dahlmanns,

Lohmöller,

Pennekamp

et al. 2022

Preprint

View full text Add to dashboard Cite

The ongoing trend to move industrial appliances from previously isolated networks to the Internet requires fundamental changes in security to uphold secure and safe operation. Consequently, to ensure end-to-end secure communication and authentication, (i) traditional industrial protocols, e.g., Modbus, are retrofitted with TLS support, and (ii) modern protocols, e.g., MQTT, are directly designed to use TLS. To understand whether these changes indeed lead to secure Industrial Internet of Things deployments, i.e., using TLS-based protocols, which are configured according to security best practices, we perform an Internet-wide security assessment of ten industrial protocols covering the complete IPv4 address space.Our results show that both, retrofitted existing protocols and newly developed secure alternatives, are barely noticeable in the wild. While we find that new protocols have a higher TLS adoption rate than traditional protocols (7.2 % vs. 0.4 %), the overall adoption of TLS is comparably low (6.5 % of hosts). Thus, most industrial deployments (934,736 hosts) are insecurely connected to the Internet. Furthermore, we identify that 42 % of hosts with TLS support (26,665 hosts) show security deficits, e.g., missing access control. Finally, we show that support in configuring systems securely, e.g., via configuration templates, is promising to strengthen security. CCS CONCEPTS• Networks → Security protocols; • Security and privacy → Security protocols.

show abstract

Section: Tls Foundationsmentioning

confidence: 99%

“…To this end, we use official guidelines listing adequate TLS versions [28,68] and cipher suites [89]. deprecated and insecure due to their reliance on SHA1 [68,90].…”

Section: Tls Foundationsmentioning

confidence: 99%

Missed Opportunities: Measuring the Untapped TLS Support in the Industrial Internet of Things

Dahlmanns,

Lohmöller,

Pennekamp

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…The current up-to-date version of TLS is TLS 1.3, defined in RFC 8446 [38]. However, a few of its previous versions (i.e., TLS 1.0 and TLS 1.1) were deprecated in March 2021 [39]. According to a report by Qualys SSL Labs [40] in October 2021, 99.6% of the surveyed websites support TLS 1.2 [41], and approximately half (49.7%) of the websites support TLS 1.3, while less than a half support TLS 1.0 and TLS 1.1.…”

Section: Basics Of Ssl/tlsmentioning

confidence: 99%

A Survey on TLS-Encrypted Malware Network Traffic Analysis Applicable to Security Operations Centers

Roh

2021

Applied Sciences

View full text Add to dashboard Cite

Recently, a majority of security operations centers (SOCs) have been facing a critical issue of increased adoption of transport layer security (TLS) encryption on the Internet, in network traffic analysis (NTA). To this end, in this survey article, we present existing research on NTA and related areas, primarily focusing on TLS-encrypted traffic to detect and classify malicious traffic with deployment scenarios for SOCs. Security experts in SOCs and researchers in academia can obtain useful information from our survey, as the main focus of our survey is NTA methods applicable to malware detection and family classification. Especially, we have discussed pros and cons of three main deployment models for encrypted NTA: TLS interception, inspection using cryptographic functions, and passive inspection without decryption. In addition, we have discussed the state-of-the-art methods in TLS-encrypted NTA for each component of a machine learning pipeline, typically used in the state-of-the-art methods.

show abstract

“…This section briefly summarizes the TLS protocol details relevant to our contribution. Note: As of 2021 all version below TLS 1.2 have been deprecated [12], so that we will only focus on TLS 1.2 and 1.3.…”

Section: Tls Fundamentalsmentioning

confidence: 99%

Passive, Transparent, and Selective TLS Decryption for Network Security Monitoring

Wilkens¹,

Haas²,

Amann³

et al. 2021

Preprint

View full text Add to dashboard Cite

Internet traffic is increasingly encrypted. While this protects the confidentiality and integrity of communication, it prevents network monitoring systems (NMS) and intrusion detection systems (IDSs) from effectively analyzing the now encrypted payloads. Therefore, many enterprise networks have deployed man-in-themiddle (MitM) proxies that intercept TLS connections at the network border to examine packet payloads and thus retain some visibility. However, recent studies have shown that TLS interception often reduces connection security and potentially introduces additional attack vectors to the network. In this paper, we present a cooperative approach in which end-hosts as cryptographic endpoints selectively provide TLS key material to NMS for decryption. This enables endpoints to control who can decrypt which content and lets users retain privacy for chosen connections. We implement a prototype based on the Zeek NMS that is able to receive key material from hosts, decrypt TLS connections and perform analyzes on the cleartext. The patch is freely available and we plan to upstream our changes to Zeek once they are mature enough. In our evaluation, we discuss how our approach conceptually requires significantly less computational resources compared to the commonly deployed MitM proxies. Our experimental results indicate, that TLS decryption increases a runtime overhead of about 2.5 times of the original runtime on cleartext. Additionally, we show that the latency for transmitting keys between hosts and the NMS can be effectively addressed by buffering traffic at the NMS for at least 40ms, allowing successful decryption of 99.99% of all observed TLS connections.

show abstract

Deprecating TLS 1.0 and TLS 1.1

Cited by 21 publications

References 0 publications

Missed Opportunities: Measuring the Untapped TLS Support in the Industrial Internet of Things

Missed Opportunities: Measuring the Untapped TLS Support in the Industrial Internet of Things

A Survey on TLS-Encrypted Malware Network Traffic Analysis Applicable to Security Operations Centers

Passive, Transparent, and Selective TLS Decryption for Network Security Monitoring

Contact Info

Product

Resources

About