Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits

Olivier Levillain

doi:10.1007/978-3-030-68887-5_5

Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits

Olivier Levillain

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

In the years leading to the definition of TLS 1.3, many vulnerabilities have been published on the TLS protocol, including numerous implementation flaws affecting a wide range of independent stacks. The infamous Heartbleed bug, was estimated to affect more than 20% of the most popular HTTPS servers. We propose a structured review of these implementation flaws. By considering their consequences but also their root causes, we present some lessons learned or yet to be learned. We also assess the impact of TLS 1.3, the latest version of the protocol, on the security of SSL/TLS implementations.

Original language	English
Title of host publication	Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers
Editors	Joaquin Garcia-Alfaro, Jean Leneutre, Nora Cuppens, Reda Yaich
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	87-104
Number of pages	18
ISBN (Print)	9783030688868
DOIs	https://doi.org/10.1007/978-3-030-68887-5_5
Publication status	Published - 1 Jan 2021
Event	15th International Conference on Risks and Security of Internet and Systems, CRISIS 2020 - Virtual, Online Duration: 4 Nov 2020 → 6 Nov 2020

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	12528 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	15th International Conference on Risks and Security of Internet and Systems, CRISIS 2020
City	Virtual, Online
Period	4/11/20 → 6/11/20

Access to Document

10.1007/978-3-030-68887-5_5

Cite this

Levillain, O. (2021). Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits. In J. Garcia-Alfaro, J. Leneutre, N. Cuppens, & R. Yaich (Eds.), Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers (pp. 87-104). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12528 LNCS). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-3-030-68887-5_5

Levillain, Olivier. / Implementation Flaws in TLS Stacks : Lessons Learned and Study of TLS 1.3 Benefits. Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers. editor / Joaquin Garcia-Alfaro ; Jean Leneutre ; Nora Cuppens ; Reda Yaich. Springer Science and Business Media Deutschland GmbH, 2021. pp. 87-104 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{b6fac68b90e74ac8b5308fe0632c2dda,

title = "Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits",

abstract = "In the years leading to the definition of TLS 1.3, many vulnerabilities have been published on the TLS protocol, including numerous implementation flaws affecting a wide range of independent stacks. The infamous Heartbleed bug, was estimated to affect more than 20\% of the most popular HTTPS servers. We propose a structured review of these implementation flaws. By considering their consequences but also their root causes, we present some lessons learned or yet to be learned. We also assess the impact of TLS 1.3, the latest version of the protocol, on the security of SSL/TLS implementations.",

author = "Olivier Levillain",

note = "Publisher Copyright: {\textcopyright} 2021, Springer Nature Switzerland AG.; 15th International Conference on Risks and Security of Internet and Systems, CRISIS 2020 ; Conference date: 04-11-2020 Through 06-11-2020",

year = "2021",

month = jan,

day = "1",

doi = "10.1007/978-3-030-68887-5\_5",

language = "English",

isbn = "9783030688868",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "87--104",

editor = "Joaquin Garcia-Alfaro and Jean Leneutre and Nora Cuppens and Reda Yaich",

booktitle = "Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers",

}

Levillain, O 2021, Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits. in J Garcia-Alfaro, J Leneutre, N Cuppens & R Yaich (eds), Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 12528 LNCS, Springer Science and Business Media Deutschland GmbH, pp. 87-104, 15th International Conference on Risks and Security of Internet and Systems, CRISIS 2020, Virtual, Online, 4/11/20. https://doi.org/10.1007/978-3-030-68887-5_5

Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits. / Levillain, Olivier.
Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers. ed. / Joaquin Garcia-Alfaro; Jean Leneutre; Nora Cuppens; Reda Yaich. Springer Science and Business Media Deutschland GmbH, 2021. p. 87-104 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12528 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Implementation Flaws in TLS Stacks

T2 - 15th International Conference on Risks and Security of Internet and Systems, CRISIS 2020

AU - Levillain, Olivier

PY - 2021/1/1

Y1 - 2021/1/1

N2 - In the years leading to the definition of TLS 1.3, many vulnerabilities have been published on the TLS protocol, including numerous implementation flaws affecting a wide range of independent stacks. The infamous Heartbleed bug, was estimated to affect more than 20% of the most popular HTTPS servers. We propose a structured review of these implementation flaws. By considering their consequences but also their root causes, we present some lessons learned or yet to be learned. We also assess the impact of TLS 1.3, the latest version of the protocol, on the security of SSL/TLS implementations.

AB - In the years leading to the definition of TLS 1.3, many vulnerabilities have been published on the TLS protocol, including numerous implementation flaws affecting a wide range of independent stacks. The infamous Heartbleed bug, was estimated to affect more than 20% of the most popular HTTPS servers. We propose a structured review of these implementation flaws. By considering their consequences but also their root causes, we present some lessons learned or yet to be learned. We also assess the impact of TLS 1.3, the latest version of the protocol, on the security of SSL/TLS implementations.

U2 - 10.1007/978-3-030-68887-5_5

DO - 10.1007/978-3-030-68887-5_5

M3 - Conference contribution

AN - SCOPUS:85102631771

SN - 9783030688868

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 87

EP - 104

BT - Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers

A2 - Garcia-Alfaro, Joaquin

A2 - Leneutre, Jean

A2 - Cuppens, Nora

A2 - Yaich, Reda

PB - Springer Science and Business Media Deutschland GmbH

Y2 - 4 November 2020 through 6 November 2020

ER -

Levillain O. Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits. In Garcia-Alfaro J, Leneutre J, Cuppens N, Yaich R, editors, Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers. Springer Science and Business Media Deutschland GmbH. 2021. p. 87-104. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-68887-5_5

Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits

Abstract

Publication series

Conference

Access to Document

Fingerprint

Cite this