Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits

Olivier Levillain

doi:10.1007/978-3-030-68887-5_5

Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits

Olivier Levillain

Résultats de recherche: Le chapitre dans un livre, un rapport, une anthologie ou une collection › Contribution à une conférence › Revue par des pairs

Résumé

In the years leading to the definition of TLS 1.3, many vulnerabilities have been published on the TLS protocol, including numerous implementation flaws affecting a wide range of independent stacks. The infamous Heartbleed bug, was estimated to affect more than 20% of the most popular HTTPS servers. We propose a structured review of these implementation flaws. By considering their consequences but also their root causes, we present some lessons learned or yet to be learned. We also assess the impact of TLS 1.3, the latest version of the protocol, on the security of SSL/TLS implementations.

langue originale	Anglais
titre	Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers
rédacteurs en chef	Joaquin Garcia-Alfaro, Jean Leneutre, Nora Cuppens, Reda Yaich
Editeur	Springer Science and Business Media Deutschland GmbH
Pages	87-104
Nombre de pages	18
ISBN (imprimé)	9783030688868
Les DOIs	https://doi.org/10.1007/978-3-030-68887-5_5
état	Publié - 1 janv. 2021
Evénement	15th International Conference on Risks and Security of Internet and Systems, CRISIS 2020 - Virtual, Online Durée: 4 nov. 2020 → 6 nov. 2020

Série de publications

Nom	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	12528 LNCS
ISSN (imprimé)	0302-9743
ISSN (Electronique)	1611-3349

Une conférence

Une conférence	15th International Conference on Risks and Security of Internet and Systems, CRISIS 2020
La ville	Virtual, Online
période	4/11/20 → 6/11/20

Accès au document

10.1007/978-3-030-68887-5_5

Contient cette citation

Levillain, O. (2021). Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits. Dans J. Garcia-Alfaro, J. Leneutre, N. Cuppens, & R. Yaich (eds.), Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers (p. 87-104). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol 12528 LNCS). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-3-030-68887-5_5

Levillain, Olivier. / Implementation Flaws in TLS Stacks : Lessons Learned and Study of TLS 1.3 Benefits. Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers. Editeur / Joaquin Garcia-Alfaro ; Jean Leneutre ; Nora Cuppens ; Reda Yaich. Springer Science and Business Media Deutschland GmbH, 2021. p. 87-104 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{b6fac68b90e74ac8b5308fe0632c2dda,

title = "Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits",

abstract = "In the years leading to the definition of TLS 1.3, many vulnerabilities have been published on the TLS protocol, including numerous implementation flaws affecting a wide range of independent stacks. The infamous Heartbleed bug, was estimated to affect more than 20\% of the most popular HTTPS servers. We propose a structured review of these implementation flaws. By considering their consequences but also their root causes, we present some lessons learned or yet to be learned. We also assess the impact of TLS 1.3, the latest version of the protocol, on the security of SSL/TLS implementations.",

author = "Olivier Levillain",

note = "Publisher Copyright: {\textcopyright} 2021, Springer Nature Switzerland AG.; 15th International Conference on Risks and Security of Internet and Systems, CRISIS 2020 ; Conference date: 04-11-2020 Through 06-11-2020",

year = "2021",

month = jan,

day = "1",

doi = "10.1007/978-3-030-68887-5\_5",

language = "English",

isbn = "9783030688868",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "87--104",

editor = "Joaquin Garcia-Alfaro and Jean Leneutre and Nora Cuppens and Reda Yaich",

booktitle = "Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers",

}

Levillain, O 2021, Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits. Dans J Garcia-Alfaro, J Leneutre, N Cuppens & R Yaich (eds), Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), VOL. 12528 LNCS, Springer Science and Business Media Deutschland GmbH, p. 87-104, 15th International Conference on Risks and Security of Internet and Systems, CRISIS 2020, Virtual, Online, 4/11/20. https://doi.org/10.1007/978-3-030-68887-5_5

Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits. / Levillain, Olivier.
Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers. Ed. / Joaquin Garcia-Alfaro; Jean Leneutre; Nora Cuppens; Reda Yaich. Springer Science and Business Media Deutschland GmbH, 2021. p. 87-104 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol 12528 LNCS).

Résultats de recherche: Le chapitre dans un livre, un rapport, une anthologie ou une collection › Contribution à une conférence › Revue par des pairs

TY - GEN

T1 - Implementation Flaws in TLS Stacks

T2 - 15th International Conference on Risks and Security of Internet and Systems, CRISIS 2020

AU - Levillain, Olivier

PY - 2021/1/1

Y1 - 2021/1/1

N2 - In the years leading to the definition of TLS 1.3, many vulnerabilities have been published on the TLS protocol, including numerous implementation flaws affecting a wide range of independent stacks. The infamous Heartbleed bug, was estimated to affect more than 20% of the most popular HTTPS servers. We propose a structured review of these implementation flaws. By considering their consequences but also their root causes, we present some lessons learned or yet to be learned. We also assess the impact of TLS 1.3, the latest version of the protocol, on the security of SSL/TLS implementations.

AB - In the years leading to the definition of TLS 1.3, many vulnerabilities have been published on the TLS protocol, including numerous implementation flaws affecting a wide range of independent stacks. The infamous Heartbleed bug, was estimated to affect more than 20% of the most popular HTTPS servers. We propose a structured review of these implementation flaws. By considering their consequences but also their root causes, we present some lessons learned or yet to be learned. We also assess the impact of TLS 1.3, the latest version of the protocol, on the security of SSL/TLS implementations.

U2 - 10.1007/978-3-030-68887-5_5

DO - 10.1007/978-3-030-68887-5_5

M3 - Conference contribution

AN - SCOPUS:85102631771

SN - 9783030688868

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 87

EP - 104

BT - Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers

A2 - Garcia-Alfaro, Joaquin

A2 - Leneutre, Jean

A2 - Cuppens, Nora

A2 - Yaich, Reda

PB - Springer Science and Business Media Deutschland GmbH

Y2 - 4 November 2020 through 6 November 2020

ER -

Levillain O. Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits. Dans Garcia-Alfaro J, Leneutre J, Cuppens N, Yaich R, rédacteurs en chef, Risks and Security of Internet and Systems - 15th International Conference, CRiSIS 2020, Revised Selected Papers. Springer Science and Business Media Deutschland GmbH. 2021. p. 87-104. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-68887-5_5

Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits

Résumé

Série de publications

Une conférence

Accès au document

Empreinte digitale

Contient cette citation