BadRandom: A survey of TLS Implementations.
The security of encrypted internet traffic forms a critical part of global commerce today, from social media to business banking. It is critical to know if these protocols, algorithms, and implementations are indeed secure. If a device is not following the TLS protocol or can not create secure random numbers, the proof of security does not apply and could be catastrophic to the security of the user.
We collected and analyzed the Client and Server Hello Random values from 2 billion TLS connections. We found implementations that admit not following the specification, implementations that do not seem to care, and other unknown implementations with low entropy. Theory states and the proof of security of TLS assumes that we should have seen a single repeated value with probability 10^{-50}. We found more than 20,000.
The takeaway from this research is twofold. First, we need a broader community to help find these devices, and long term, the cryptographic community needs to create provable deterministic protocols that only work when implemented correctly.
Bio:
James is a Ph.D. candidate in CS and teaches Graduate level Cryptography at UCSC. James has published papers in Storage, Networking, Security, and Cryptography and has accumulated more than 50 patents during his years in the computer industry.
Join us via Zoom: https://ucsc.zoom.us/j/94193557755?pwd=Yy8xMmYxQXU4V3BDUjN4SGIwRlJ5dz09 / Passcode: 164805
**Access to the recording is reserved for CRSS sponsors and members.**
Please contact Cynthia McCarley (cynmccar@ucsc.edu) if you are a CRSS member or Deep Dive guest that did not receive an email with the password to the recording.
When:
Thursday, August 26, 2021 at 11:00 AM
Where:
UCSC, Room E2-599 and Virtual
Slides:
Material from the event
CRSS Contact:
Hughes, James
Last modified 15 Nov 2021