Modernes SSL/TLS-Setup mit Apache - Revision history

Wedel: /* Benchmarks */

2013-09-28T16:03:18Z

Benchmarks

← Older revision		Revision as of 16:03, 28 September 2013
Line 51:		Line 51:

	===Benchmarks===		===Benchmarks===
	[[File:~~wasupTLS_Bench_local1~~.png]]		[[File:wasupTLS_Bench_Local1.png]]
	[[File:~~wasupTLS_Bench_local2~~.png]]		[[File:wasupTLS_Bench_Local2.png]]
	[[File:wasupTLS_Bench_packets.png]]		[[File:wasupTLS_Bench_packets.png]]
	[[File:wasupTLS_Bench_remote.png]]		[[File:wasupTLS_Bench_remote.png]]

Wedel: /* Benchmarks */

2013-09-28T16:01:49Z

Benchmarks

← Older revision		Revision as of 16:01, 28 September 2013
Line 51:		Line 51:

	===Benchmarks===		===Benchmarks===
			[[File:wasupTLS_Bench_local1.png]]
	coming soon
			[[File:wasupTLS_Bench_local2.png]]
			[[File:wasupTLS_Bench_packets.png]]
			[[File:wasupTLS_Bench_remote.png]]
			[[File:wasupTLS_Bench_remote_keepalive.png]]

	==What needs to be done...? ==		==What needs to be done...? ==

Wedel: /* Benchmarks */

2013-09-27T16:45:05Z

Benchmarks

← Older revision		Revision as of 16:45, 27 September 2013
Line 51:		Line 51:

	===Benchmarks===		===Benchmarks===
			coming soon
	to do

	==What needs to be done...? ==		==What needs to be done...? ==

Wedel: /* Weblinks */

2013-09-27T15:29:45Z

Weblinks

← Older revision		Revision as of 15:29, 27 September 2013
Line 62:		Line 62:

	==Weblinks==		==Weblinks==
	https://github.com/t2d/wasuptls		* https://github.com/t2d/wasuptls
			* https://www.ssllabs.com/downloads/SSL_TLS_Deployment_Best_Practices_1.3.pdf
			* http://www.heise.de/security/artikel/Forward-Secrecy-testen-und-einrichten-1932806.html
			* http://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
			* https://github.com/ioerror/duraconf
			* https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html
			* https://httpd.apache.org/docs/2.4/mod/mod_ssl.html
			* https://isecpartners.com/media/106031/ssl_attacks_survey.pdf

Wedel: /* Elliptic curve cryptography (ECC) */

2013-09-27T15:19:18Z

Elliptic curve cryptography (ECC)

← Older revision		Revision as of 15:19, 27 September 2013
Line 7:		Line 7:
	Use a 2048 or 4096 Bit RSA Key? It might be better to use ECC – the same strength with 224 Bits (and they might even be faster). <br />		Use a 2048 or 4096 Bit RSA Key? It might be better to use ECC – the same strength with 224 Bits (and they might even be faster). <br />
	'''ECDH''' - Elliptic Curve Diffie–Hellman-Keyagreement<br />		'''ECDH''' - Elliptic Curve Diffie–Hellman-Keyagreement<br />
	'''ECDSA''' – for digital signatures <br />		'''ECDSA''' – for digital signatures, so its possible to use ECC-Certificates (which are not yet available with ECC-singing). <br />

	In Apache its possible to use SSLCertificate's in parallel, so you can use a ECC-Certificate and in parallel have a fallback-certificate using RSA-signatures: <br />		In Apache its possible to use SSLCertificate's in parallel, so you can use a ECC-Certificate and in parallel have a fallback-certificate using RSA-signatures: <br />

Wedel: /* Elliptic curve cryptography (ECC) */

2013-09-27T15:15:23Z

Elliptic curve cryptography (ECC)

← Older revision		Revision as of 15:15, 27 September 2013
Line 9:		Line 9:
	'''ECDSA''' – for digital signatures <br />		'''ECDSA''' – for digital signatures <br />

	In Apache its possible to use SSLCertificate's in parallel, so you can use a ECC-Certificate and in parallel have fallback-certificate using RSA-signatures: <br />		In Apache its possible to use SSLCertificate's in parallel, so you can use a ECC-Certificate and in parallel have a fallback-certificate using RSA-signatures: <br />
	<code>SSLCertificateFile "@rel_sysconfdir@/server.crt"<br />		<code>SSLCertificateFile "@rel_sysconfdir@/server.crt"<br />
	SSLCertificateFile "@rel_sysconfdir@/server-dsa.crt"<br />		SSLCertificateFile "@rel_sysconfdir@/server-dsa.crt"<br />

Wedel: /* Recent attacks on SSL/TLS */

2013-09-27T15:14:55Z

Recent attacks on SSL/TLS

← Older revision		Revision as of 15:14, 27 September 2013
Line 1:		Line 1:
	Apache2 TLS config with recent attacks in mind		Apache2 TLS config with recent attacks in mind
	==Recent attacks on SSL/TLS==		==Recent attacks on SSL/TLS==
	There where many attacks since 2011: BEAST, CRIME, TIME, BREACH, Lucky13 and last but not least RC4 Biases in TLS. Some of them are mitigated through ~~Workarounds~~ in Browsers or Webserver-Software, some are mitigated with TLS1.2 and some, at least in case of BREACH and Lucky13, still threaten TLS/SSL. For details on the attacks and the mitigation read the [https://isecpartners.com/media/106031/ssl_attacks_survey.pdf SSL attack survey].		There where many attacks since 2011: BEAST, CRIME, TIME, BREACH, Lucky13 and last but not least RC4 Biases in TLS. Some of them are mitigated through workarounds in Browsers or Webserver-Software, some are mitigated with TLS1.2 and some, at least in case of BREACH and Lucky13, still threaten TLS/SSL. For details on the attacks and the mitigation read the [https://isecpartners.com/media/106031/ssl_attacks_survey.pdf SSL attack survey].

	==Conceptual improvements on SSL/TLS==		==Conceptual improvements on SSL/TLS==

Wedel: /* Project: wasupTLS */

2013-09-27T15:14:16Z

Project: wasupTLS

← Older revision		Revision as of 15:14, 27 September 2013
Line 25:		Line 25:

	==Project: wasupTLS==		==Project: wasupTLS==
	The ~~Goal~~ is to provide an Apache2 configuration for websites with sensible data. It must work ''today'' and not exclude any users. Instead users with unsafe browsers should be warned.		The goal is to provide an Apache2 configuration for websites with sensible data. It must work ''today'' and not exclude any users. Instead users with unsafe browsers should be warned.
	The project consists of three parts which should be used together:		The project consists of three parts which should be used together:
	* Apache2 config file		* Apache2 config file

Wedel: Created page with "Apache2 TLS config with recent attacks in mind ==Recent attacks on SSL/TLS== There where many attacks since 2011: BEAST, CRIME, TIME, BREACH, Lucky13 and last but not least RC4 B…"

2013-09-27T15:13:01Z

Created page with "Apache2 TLS config with recent attacks in mind ==Recent attacks on SSL/TLS== There where many attacks since 2011: BEAST, CRIME, TIME, BREACH, Lucky13 and last but not least RC4 B…"

New page

Apache2 TLS config with recent attacks in mind
==Recent attacks on SSL/TLS==
There where many attacks since 2011: BEAST, CRIME, TIME, BREACH, Lucky13 and last but not least RC4 Biases in TLS. Some of them are mitigated through Workarounds in Browsers or Webserver-Software, some are mitigated with TLS1.2 and some, at least in case of BREACH and Lucky13, still threaten TLS/SSL. For details on the attacks and the mitigation read the [https://isecpartners.com/media/106031/ssl_attacks_survey.pdf SSL attack survey].

==Conceptual improvements on SSL/TLS==
===Elliptic curve cryptography (ECC)===
Use a 2048 or 4096 Bit RSA Key? It might be better to use ECC – the same strength with 224 Bits (and they might even be faster). 
'''ECDH''' - Elliptic Curve Diffie–Hellman-Keyagreement 
'''ECDSA''' – for digital signatures 

In Apache its possible to use SSLCertificate's in parallel, so you can use a ECC-Certificate and in parallel have fallback-certificate using RSA-signatures: 
<code>SSLCertificateFile "@rel_sysconfdir@/server.crt" 
SSLCertificateFile "@rel_sysconfdir@/server-dsa.crt" 
SSLCertificateFile "@rel_sysconfdir@/server-ecc.crt"</code>

===Forward Secrecy===
Ensures that a session key deduced from a key will not be compromised if the private keys is compromised in the future. Uses (elliptic curve) Diffie–Hellman-Keyagreement. In theory, Transport Layer Security (TLS) can choose appropriate ciphers since SSLv3. OpenSSL supports perfect forward secrecy using elliptic curve Diffie–Hellman since version 1.0, with a computational overhead of approximately 15%.

===Key-Pinning===
Certificates are usually validated by checking the signature hierarchy. Key-Pinning is the process of associating a host with their expected X509 certificate or public key. Once a certificate or public key is known for a host, the certificate or public key is associated or 'pinned' to the host.
There are two IETF-Drafts:
* [http://tools.ietf.org/html/draft-perrin-tls-tack-02 Public Key Pinning Extension for HTTP ('''HPKP''')]
* [http://tools.ietf.org/html/draft-ietf-websec-key-pinning-04 Trust Assertions for Certificate Keys ('''TACK''')]
Both are not yet stable.

==Project: wasupTLS==
The Goal is to provide an Apache2 configuration for websites with sensible data. It must work ''today'' and not exclude any users. Instead users with unsafe browsers should be warned.
The project consists of three parts which should be used together:
* Apache2 config file
* Server-side script to export TLS information
* Client-side script to warn users with unsafe browsers
Fork at https://github.com/t2d/wasuptls

Our Decisions:
* Based on stable software (Debian wheezy, OpenSSL 1.0.1e and Apache 2.4)
* Export TLS information via SSI
* BEAST is considered to be mitigated client-side, Priority is Forward Secrecy -> no RC4
* Prefer ECDHE over DHE
* HTTP Strict Transport Security
* No Key-Pinning as it isn't stable at the moment.

The '''Apache Config''': 
<code>SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2 
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AES:RSA+3DES:!ADH:!AECDH:!MD5:!DSS:!aNULL
SSLHonorCipherOrder on 
SSLCompression off
Header append Strict-Transport-Security "max-age=15768000 ; includeSubDomains"
Header always append X-Frame-Options "sameorigin"</code>

The '''JavaScript''' tests if cipher suite is using Forward Secrecy, No SSLv3, No RC4, No 3DES. If not, we warn the user with a pop-up containing information about her_his vulnerability.

===Benchmarks===
to do

==What needs to be done...? ==

* Watch Key-Pinning
* Push upgrade process to TLS1.2
* Get rid of RC4
* Tune sites for TLS
* Watch SPDY/HTTP2 (Reduced amount of roundtrips)

==Weblinks==
https://github.com/t2d/wasuptls