Coming of Age: a Longitudinal Study of TLS Deployment
Total Page：16
File Type：pdf, Size：1020Kb
Coming of Age: A Longitudinal Study of TLS Deployment Platon Kotzias Abbas Razaghpanah Johanna Amann IMDEA Software Institute Stony Brook University ICSI/Corelight/LBNL Universidad Politécnica de Madrid Kenneth G. Paterson Narseo Vallina-Rodriguez Juan Caballero Royal Holloway, University of London IMDEA Networks Institute IMDEA Software Institue ICSI ABSTRACT of each new attack and vulnerability that is discovered. Over the The Transport Layer Security (TLS) protocol is the de-facto standard last few years various TLS vulnerabilities such as BEAST, Lucky for encrypted communication on the Internet. However, it has been 13, POODLE, Heartbleed, FREAK, Logjam, and multiple attacks plagued by a number of different attacks and security issues over against RC4 have been discovered. The Snowden revelations have the last years. Addressing these attacks requires changes to the also highlighted weaknesses in TLS, specifically the reliance on protocol, to server- or client-software, or to all of them. In this RSA key transport for establishing keying material, a method that paper we conduct the first large-scale longitudinal study examining can be passively broken by an entity in possession of the server’s the evolution of the TLS ecosystem over the last six years. We RSA private key. Addressing these attacks requires changes to place a special focus on the ecosystem’s evolution in response to the protocol, to server-, or to client-software, or to all of them high-profile attacks. simultaneously. For our analysis, we use a passive measurement dataset with Prior work highlights different parts of the TLS ecosystem like more than 319.3B connections since February 2012, and an active specific attacks [6, 9, 10, 17, 41, 44, 44, 63, 74, 82], problems ofthe dataset that contains TLS and SSL scans of the entire IPv4 address PKI [7, 46, 54, 60] or problems of TLS usage in specific areas like on space since August 2015. To identify the evolution of specific clients mobile devices [47, 71, 83]. However, to the best of our knowledge, we also create the—to our knowledge—largest TLS client fingerprint no prior work has examined the specific impact of security issues database to date, consisting of 1,684 fingerprints. on protocol deployment. We observe that the ecosystem has shifted significantly since In this paper, we conduct a large-scale longitudinal study exam- 2012, with major changes in which cipher suites and TLS extensions ining the evolution of the TLS ecosystem since 2012 both on the are offered by clients and accepted by servers having taken place. client and on the server side. We analyze trends and evolution of the Where possible, we correlate these with the timing of specific at- ecosystem, putting a special focus on changes occurring in response tacks on TLS. At the same time, our results show that while clients, to specific high-profile attacks. For this, we use a combination of especially browsers, are quick to adopt new algorithms, they are passive and active measurement data. Our passive measurements also slow to drop support for older ones. We also encounter signif- have been running continuously since February 2012 and currently icant amounts of client software that probably unwittingly offer contain protocol information about more than 319.3B TLS connec- unsafe ciphers. We discuss these findings in the context of long tail tions. The active measurement data provided to us by Censys [42] effects in the TLS ecosystem. contains SSL and TLS scans of the entire IPv4 address space starting from August 2015. ACM Reference Format: To identify the patching behavior and evolution of specific clients Platon Kotzias, Abbas Razaghpanah, Johanna Amann, Kenneth G. Pater- we also create the—to our knowledge—largest TLS client fingerprint son, Narseo Vallina-Rodriguez, and Juan Caballero. 2018. Coming of Age: A Longitudinal Study of TLS Deployment. In 2018 Internet Measurement database to date, consisting of 1,684 fingerprints. These fingerprints Conference (IMC ’18), October 31-November 2, 2018, Boston, MA, USA. ACM, allow us to attribute 69.26% of TLS connections to specific TLS- New York, NY, USA, 14 pages. https://doi.org/10.1145/3278532.3278568 using programs or libraries. Using these fingerprints we discover that while clients, especially browsers, are quick to adopt new al- 1 INTRODUCTION gorithms, they are also slow to drop support for older ones. We also encounter significant amounts of client software that probably The Transport Layer Security (TLS) protocol is the most widely unwittingly offer unsafe ciphers. We discuss these findings inthe used encrypted communication protocol on the Internet. However, context of long tail effects arising from the desire to maintain back- in order to stay secure, it has had to constantly evolve in the face wards compatibility, software abandonment, and the difficulties Permission to make digital or hard copies of all or part of this work for personal or faced by users of TLS (in a broad sense) in keeping up-to-date with classroom use is granted without fee provided that copies are not made or distributed proper TLS usage. for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the Our analysis, shows radical changes in the TLS ecosystem over author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or the last 6 years. In 2012, 90% of TLS connections used TLS 1.0, while republish, to post on servers or to redistribute to lists, requires prior specific permission today 90% use TLS 1.2, with TLS 1.3 traffic increasing rapidly. In and/or a fee. Request permissions from [email protected]. IMC ’18, October 31-November 2, 2018, Boston, MA, USA 2012, the use of RC4 and CBC-mode for encryption was prevalent; © 2018 Copyright held by the owner/author(s). Publication rights licensed to ACM. today RC4 has almost completely disappeared in response to at- ACM ISBN 978-1-4503-5619-0/18/10...$15.00 tacks, while CBC-mode accounts for about 10% of traffic. RC4 and https://doi.org/10.1145/3278532.3278568 IMC ’18, October 31-November 2, 2018, Boston, MA, USA Kotzias et al. CBC-mode have been largely replaced by modern AEAD schemes, to the server listing its capabilities such as the maximum protocol especially AES-GCM. We observe significant declines in the adver- version, the cipher suites, and elliptic curves it supports. The server tisement and use of export cipher suites, anonymous cipher suites, then chooses its preferred options, among those offered by the and vintage algorithms like 3DES. We also see a rise in the use of client, and informs the client of its choices in the Server Hello forward-secret cipher suites, now accounting for more than 90% message. Thus, the server chooses the final protocol version, cipher of connections. Ephemeral elliptic-curve-based Diffie-Hellman key suite, and other parameters that will be used in the secure channel. exchange (ECDHE) now dominates RSA key transport in TLS hand- Table 1 lists the release dates of all SSL/TLS versions. A key shakes, with Curve25519 gaining in popularity and accounting for feature added in TLS 1.0 over the earlier SSL protocol versions are more than 20% of connections today. TLS extensions used for adding TLS functionality and TLS protocol We correlate major changes in the use of cipher suites and TLS message formats [40]. The client includes in the Client Hello all the extensions with the timing of specific TLS attacks and assess the extensions that it supports and the server simply ignores extensions impact of security research. We observe a few cases, like HeartBleed, that it does not understand. As of March 2018, 28 TLS extensions where the ecosystem changed very quickly. We also observe a have been standardized [57]. It is also possible for anyone to define strong correlation in time between Snowden revelations and the their own extensions. change to forward-secret ciphers. On the other hand, it took several years for RC4 usage to reduce significantly after attacks against 2.2 TLS Attacks RC4 were discovered. Moreover, we do not observe a change in our Many attacks against SSL/TLS have been discovered in recent years. traffic after CBC attacks, possibly due to the lack of better available As a result, both the protocol specification and individual implemen- options at the time or due to the existence of patches. At last, server tations have been significantly revised. In some cases, just changing support for SSL3 is still embarassingly high, despite the severity of client and/or server configurations was sufficient mitigation –for POODLE and RC4 attacks. example to avoid using weak cipher suites. In other cases, where Our main contributions are as follows: (i) We conduct a large- good alternatives were not widely supported or where support for scale longitudinal study on the evolution of the TLS ecosystem legacy was needed, more invasive changes to implementations were since 2012. We place a special focus on high-profile attacks and required. Finally, as we will see, clients and servers have changed detail the impact that these attacks have had on the ecosystem. the versions of the protocol they negotiate in response to attacks. (ii) We present the largest, and longest-running, passive TLS moni- Below, we provide a brief description and a timeline of the most toring dataset comprising 319.3B TLS connections collected since notable attacks, ordered by disclosure date. February 2012. We use our passive dataset, together with a large active scan dataset, to detail the changes to the TLS ecosystem since BEAST (09/06/2011) BEAST allows a MITM attacker to decrypt 2012.