Catégorie: Conférence avec actes
Auteurs: Olivier Levillain, Arnaud Ebalard, Benjamin Morin et Hervé Debar
Date: décembre 2012
Série: SSL/TLS

Over the years, SSL/TLS has become an essential part of internet security. As such, it should offer robust and state-of-the-art security, in particular for HTTPS, its first application. Theoretically, the protocol allows for a trade-off between secure algorithms and decent performance. Yet in practice, servers do not always support the latest version of the protocol, nor do they all enforce strong cryptographic algorithms.

To assess the quality of HTTPS servers in the wild, we enumerated HTTPS servers on the internet in July 2010 and July 2011. We sent several stimuli against the servers to gather detailed information. We then analysed some parameters of the collected data and looked at how they evolved. We also focused on two subsets of the TLS hosts within our measure: the trusted hosts (possessing a valid certificate at the time of the probing) and EV hosts (presenting a trusted, so-called Extended Validation certificate). Our contributions rely on this methodology: the stimuli we sent, the criteria we studied and the subsets we focused on.

Even if EV servers present a somewhat improved certificate quality over the TLS hosts, we show they do not offer overall high quality sessions, which could and should be improved.

Publié dans les actes 28th Annual Computer Security Applications Conference (pages 11 à 20)

Présenté lors de la conférence ACSAC à Orlando, FL, USA en décembre 2012

BibTeX Document Présentation