HTTPS, TLS, HSTS, CT

'There is no security built into the internet' - what does that mean?

No authentication (you only know an IP address) and no integrity/confidentiality: any party on the path (WiFi router, ISP, …) can read or modify traffic.

Two security guarantees added by TLS/HTTPS and application-level auth?

1. Authentication: of the website by the user (TLS/X.509 certificates), of the user by the website (password/MFA). 2. Integrity & confidentiality of communication (TLS encryption + integrity protection with MACs).

Two notions of 'session'?

HTTPS session at network layer (TLS, includes server authentication) vs user session at application layer (session IDs/cookies, optionally with user authentication).

Three attacker models for the web (HTTPS context)?

a) passive eavesdropper; b) active Man-in-the-Middle (malicious/compromised ISP, router, WiFi access point); c) malicious or vulnerable end points (a malicious server such as fakebank.com can act as MitM by relaying to bank.com). TLS covers a and b but not c.

TLS handshake steps (conceptually)?

1. Server sends X.509 certificate (signed by a CA, browser has trusted CA list). 2. Client checks it's not revoked (CRL). 3. Client authenticates server via challenge-response (proves knowledge of private key). 4. Agree a session key (e.g. AES). 5. HTTP traffic goes through the encrypted, MACed tunnel.

Does a self-signed certificate give any guarantee?

Yes: the client at least knows it keeps talking to the same server (but not who it really is).

What does HTTPS protect, and what is still visible?

Protects content, headers and URL parameters (confidentiality + integrity, no modify/replay), plus server authentication. Attacker still sees that two IP addresses communicate (metadata).

TLS vs SSL?

TLS is the successor of SSL (SSL 3.1 became TLS 1.0; latest is TLS 1.3). That is why X.509 certificates are called SSL certificates and libraries are called OpenSSL, BoringSSL.

Why do browsers warn about / block mixed HTTP and HTTPS content?

Mixing http and https content (e.g. iframe or script) is a bad idea: the insecure part can be read or modified by a MitM, which undermines the security of the whole page.

What is the TCB (Trusted Computing Base)?

Everything (people, software, computers) you have to trust for a given security guarantee. E.g. the browser is in the TCB for anything you do on the web. Different guarantees can have different TCBs.

What can go wrong with HTTPS? (list the attack points)

CA hacked or issues certificate to the wrong party; user misses warnings/doesn't spot a fake website; server leaks its private key; browser/app fails to check certificates properly.

Attacking HTTPS (1): buggy certificate checks?

Bugs in browsers' checks (Moxie Marlinspike, 2002-2012) and later in apps (2012: ING and ABN-AMRO apps did not check the TLS certificate).

Attacking HTTPS (2): SSL stripping - how does it work?

Sessions often start via http:// (user types rabobank.nl, or clicks a link on an HTTP page) and are redirected (302) to https. A MitM intercepts, talks HTTPS to the server but plain HTTP to the victim, rewriting https links into http. The server thinks all is fine; the user must notice the missing 's'. Attacker captures passwords/cookies, then can stop and leave the user none the wiser.

Countermeasures to SSL stripping?

More explicit HTTP warnings in browser; HTTPS-Everywhere (never use HTTP); HSTS.

What is HSTS and its header?

Strict-Transport-Security: max-age=15768000; includeSubDomains. Tells the browser to only use HTTPS for the domain; browser remembers it and rewrites later HTTP requests to HTTPS. Mandatory for Dutch government sites since 2023.

Limitation of HSTS and how it is addressed? Privacy risk?

The very first visit is still vulnerable. Fix: HSTS preload list shipped in browsers. Privacy risk: for sites not on the preload list the stored HSTS state can be abused as a tracking identifier (HSTS pinning, 'evercookie').

Attacking HTTPS (3): hacking a CA - example?

DigiNotar (2011) was hacked and fake google.com certificates were issued, presumably for use in Iran. DigiNotar issued certificates for the NL government. Detected because Chrome checks for suspicious google.com certificates.

What is Certificate Transparency (CT) and what does it protect against?

Public log of all certificates issued by all CAs. Organisations can spot rogue certificates issued in their name; browsers can spot them too. Protects against compromised or sloppy CAs.

Why don't browsers look up CT logs (e.g. crt.sh) directly?

Privacy: the log would learn which sites you visit. Instead a certificate submitted to a CT log receives a signed timestamp (SCT) proving inclusion, which the browser checks. Browser policies differ on certificates without proof.

what do HTTPS, HSTS and CT each ensure?

HTTPS/TLS: secure channel. HSTS: people actually use HTTPS, stops SSL stripping. CT: prevent/detect CA screw-ups.