Mission Accomplished? HTTPS Security after DigiNotar Johanna Amann∗ Oliver Gasser∗ Quirin Scheitle∗ ICSI / Corelight / LBNL Technical University of Munich Technical University of Munich [email protected] [email protected] [email protected] Lexi Brent Georg Carle Ralph Holz The University of Sydney Technical University of Munich The University of Sydney [email protected] [email protected] [email protected] ABSTRACT ACM Reference Format: Driven by CA compromises and the risk of man-in-the-middle Johanna Amann, Oliver Gasser, Quirin Scheitle, Lexi Brent, Georg attacks, new security features have been added to TLS, Carle, and Ralph Holz. 2017. Mission Accomplished? HTTPS Security after DigiNotar. In Proceedings of IMC ’17, London, HTTPS, and the web PKI over the past five years. These United Kingdom, November 1–3, 2017, 16 pages. include Certificate Transparency (CT), for making the CA https://doi.org/10.1145/3131365.3131401 system auditable; HSTS and HPKP headers, to harden the HTTPS posture of a domain; the DNS-based extensions CAA and TLSA, for control over certificate issuance and pinning; 1 INTRODUCTION and SCSV, for protocol downgrade protection. The compromise of the DigiNotar CA in 2011 [57] was a This paper presents the first large scale investigation of decisive event in the history of WWW security: for the first these improvements to the HTTPS ecosystem, explicitly ac- time, a CA was removed from browser root stores, because counting for their combined usage. In addition to collecting of poor infrastructure control and the subsequent issuance passive measurements at the Internet uplinks of large Uni- of forged certificates51 [ ]. In the same year, several studies versity networks on three continents, we perform the largest documented the poor state of the TLS/X.509 ecosystem in domain-based active Internet scan to date, covering 193M general [8, 24, 39]. domains. Furthermore, we track the long-term deployment Since then, a number of improvements and additions have history of new TLS security features by leveraging passive been proposed to strengthen the X.509 PKI. They include observations dating back to 2012. Certificate Transparency (CT)44 [ ], which establishes a set of We find that while deployment of new security features has publicly verifiable append-only certificate logs; HTTP Strict picked up in general, only SCSV (49M domains) and CT (7M Transport Security (HSTS) [36], which instructs browsers domains) have gained enough momentum to improve the over- to only connect through HTTPS; HPKP, which allows cer- all security of HTTPS. Features with higher complexity, such tificate pinning through HTTP headers25 [ ]; SCSV, which as HPKP, are deployed scarcely and often incorrectly. Our em- protects against protocol downgrading attacks [50]; DANE- pirical findings are placed in the context of risk, deployment TLSA, which enables HTTPS certificate pinning using the effort, and benefit of these new technologies, and actionable DNS [37]; and finally CAA [33], which allows control of cer- steps for improvement are proposed. We cross-correlate use tificate issuance through the DNS. of features and find some techniques with significant correla- In this paper, we investigate the prevalence of these tech- tion in deployment. We support reproducible research and nologies, audit the correctness of their deployment, and ex- publicly release data and code. amine the combined role they play in post-DigiNotar web security. Our contributions are as follows: We combine active CCS CONCEPTS and passive measurements to investigate the improvements • Security and privacy → Network security; to TLS and the web PKI. Our measurements include hitherto the largest active scans of the TLS/X.509 ecosystem. Rather ∗Joint first authorship. than performing an active scan of the IP address space, our scans target a list of 193M domain names. This provides a more complete view, as many HTTPS servers implement Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that the Server Name Indication (SNI) extension to serve dif- copies are not made or distributed for profit or commercial advantage ferent certificates and use different TLS configurations per and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the au- domain [71]. This domain-based approach also reduces bias thor(s) must be honored. Abstracting with credit is permitted. To copy caused by the common presence of embedded devices that otherwise, or republish, to post on servers or to redistribute to lists, happen to run web servers [16]. Our active scans originate requires prior specific permission and/or a fee. Request permissions from [email protected]. from two vantage points on opposite ends of the globe, using IMC ’17, November 1–3, 2017, London, United Kingdom both IPv4 and IPv6. We also perform passive measurements © 2017 Copyright held by the owner/author(s). Publication rights in North America, Europe, and Australia. To the best of our licensed to Association for Computing Machinery. ACM ISBN 978-1-4503-5118-8/17/11. $15.00 knowledge, this is the first time that such a geographically https://doi.org/10.1145/3131365.3131401 diverse passive TLS observation has been conducted. Our IMC ’17, November 1–3, 2017, London, United Kingdom Amann, Gasser, Scheitle, Brent, Carle, Holz data analysis uses a novel process in which active and passive that prevents browsers from validating it; it cannot be used data share the same analysis pipeline. in place of a real certificate. The log server signs the precer- We investigate each of the above technologies in depth, tificate and returns SCTs for it. These are embedded intoan particularly focusing on Certificate Transparency and new X.509 extension of the final certificate. Browsers verify the TLS and HTTPS extensions. Importantly, we also investigate embedded SCTs by reconstructing the precertificate. how these technologies are used in combination, and which At the time of writing, Google Chrome is the only popu- protection level is thereby achieved. We paint an accurate pic- lar browser that verifies SCTs. It supports all transmission ture to which degree these technologies are correctly deployed methods, and requires valid SCTs for Extended Validation and which mistakes are commonly made. We contextualize (EV) certificates, removing the EV trust indicator otherwise. our empirical findings and explore the correlation between HTTP-based extensions: HTTP Strict Transport Security complexity, benefit, and risk of each technology. Additionally, (HSTS) [36] and HTTP Public Key Pinning (HPKP) [25] are we examine the proliferation of different TLS versions by HTTP extensions that aim to increase the security of the drawing on a massive data set of global connection-level TLS HTTPS ecosystem by setting HTTP header values. HSTS information collected since 2012. instructs the client to only access a domain via HTTPS. We strive to support open science and release our active HPKP enables the server to pin specific public keys toa scan dataset to the community. Along with parsed results, domain to mitigate man-in-the-middle attacks. Browsers must we make packet-level data captures available, allowing for abort a connection if none of the pins match the certificate precise reproduction and new uses. We also feed software chain used by the domain. Both HSTS and HPKP directives changes back to the community, and publish newly created are shipped with web browsers in so-called preloading lists. tools under a permissive open-source license. Data and code SCSV Downgrade Prevention: RFC 7507 [50] defines a Sig- can be found at https://mediatum.ub.tum.de/1377982. naling Cipher Suite Value (SCSV) that is used to prevent The remainder of this paper is organized as follows. Sec- downgrade attacks in which an attacker prevents connections tion2 covers the technical background. Section3 details with strong TLS versions in order to exploit weaknesses in the related work. Section4 describes our methodology. Sec- older TLS versions. Clients commonly fall back to older TLS tions5,6,7, and8 present our results for CT, HSTS and versions if a connection attempt with a newer TLS version HPKP, SCSV, and the DNS-based extensions CAA and is unsuccessful. In this fallback case, the client appends the DANE-TLSA, respectively. Section9 shows the evolution SCSV pseudo-cipher value to its list of supported ciphers. of TLS version use over the last five years. We discuss our When receiving this SCSV, the server must abort the connec- findings and relate them to risk, cost, and benefit of thenew tion if it supports a higher protocol version. One motivation technologies in Section 10, and summarize them in Section 11. for SCSV was the infamous POODLE attack [49]. DNS-based Extensions: Both Certification Authority Autho- 2 BACKGROUND rization (CAA) [33] and TLS Authentication (TLSA) [37] are DNS record types introduced to aid certificate issuance and This section describes the TLS, HTTP, and DNS based verification, respectively. CAA indicates which CAs may HTTPS security extensions we investigate. For a general issue certificates for a domain. It also supports reporting web PKI introduction, we refer the reader to [18, 39]. in cases where a CA is requested to issue a certificate for CT: Certificate Transparency (CT) [44] aims to make un- a domain, but may not do so because of the CAA record. noticed attacks on the PKI near-impossible through public CAA was accepted by the CA/Browser forum as a mandatory disclosure of certificate issuance. Users or CAs submit certifi- step during certificate issuance [12] and became effective on cate chains for inclusion in one or more semi-trusted public September 8, 2017. logs, run by independent parties. Each log stores entries in an In contrast to all other methods, the CAA record is only append-only Merkle Hash Tree.