Thank you for joining!
Access your Pro+ Content below.
April 2019
The exploitation of flaws in the HTTPS protocol
Sponsored by TechTarget ComputerWeekly.com
In this article in our Royal Holloway security series, Gage Boyle and Kenny Paterson consider the security weaknesses of HTTPS. The presence of “HTTPS” in a website URL provides enough confidence to consider entering sensitive information such as bank or credit card detail, but even websites owned by the most reputable organisations may be exposed to attack if HTTPS is not properly implemented.
Table Of Contents
- We look at the three main reasons the Bleichenbacher attack is possible: as a direct result of a standardised and popular padding scheme (PKCS#1 v1.5) that is used in conjunction with RSA in TLS; an attacker’s ability to manipulate RSA plaintexts in a certain controlled way by modifying only the ciphertext; commonly observed information leakage from RSA decryption code.
- We also look at the reasons the attack works, such as the difficulty of securely implementing RSA in combination with PKCS#1 v1.5 padding whilst avoiding all possible attack vectors; security systems not being patched quickly enough when vulnerabilities are discovered; the same cryptographic key being used for multiple purposes across multiple servers; legacy systems being poorly maintained; and the continued use of RSA key transport to set up TLS sessions.
- We go on to consider what we should we do about it. Steps include following appropriate standards; patching systems quickly; effectively manage cryptographic keys; understanding the entire system architecture; and considering alternative algorithms for TLS key establishment.
Access this CW+ Content for Free!
Already a member? Login here
