On the Robustness of Applications Based on the SSL and TLS Security Protocols
The SSL and TLS security protocols have been designed and implemented to provide end-to-end data security. This includes data integrity that is the data cannot be modified, replayed or reordered by an attacker without being detected at the receiving endpoint. SSL and TLS however does not provide data delivery integrity, in the sense they do not guarantee that all the sent data will actually arrive at the other side. This is because, for example, SSL/TLS cannot know in advance which is the exact size of the data to be sent over the secured channel. The mosts recent versions (SSLv3 and TLSv1) provide some form of protection against loss of data records by means of sequence numbers and specialized close_notify alert messages to be sent when tearing down the SSL connection. Unfortunately, this is not enough when the last record containing application data together with the closure alert are deleted on purpose, as it happens in the truncation attacks. SSLv3/TLSv1 specifications do not indicate what should happen (at the application level) if the close_notify message never arrives at the receiver. Consequently, for applications where it is important to ascertain that the data reached untruncated the other party, it is required to have an additional control at the application level.
In this paper we show (based on practical tests) that some widely-used applications implementing SSLv3 and TLSv1 do not perform further controls on the size of the data to be received, and thus they are vulnerable to truncation attacks. For tests we implemented a specialized MITMSSL tool, used to manipulate the SSL/TLS records exchanged between two communicating parties.
Keywordssecurity SSL/TLS truncation attack MITM attack
Unable to display preview. Download preview PDF.
- 1.OpenSSL library, available at http://www.openssl.org
- 2.SSL 3.0 Specification, available at http://wp.netscape.com/eng/ssl3/
- 3.Dierks, T., Allen, C.: The TLS Protocol Version 1.0. RFC 2246, IETF (January 1999)Google Scholar
- 4.Dierks, T., Rescorla, E.: The Transport Layer Security (TLS) Protocol Version 1.1. RFC 4346, IETF (April 2006)Google Scholar
- 6.Oppliger, R.: Security Technologies for the World Wide Web, 2nd edn. Artech House Publishers, Norwood, MA (2003)Google Scholar
- 7.Wagner, D., Schneier, B.: Analysis of the SSL 3.0 Protocol. In: Proc. of The Second USENIX Workshop on Electronic Commerce Proceedings, November 1996, pp. 29–40. USENIX Press (1996)Google Scholar
- 8.Brumley, D., Boneh, D.: Remote Timing Attacks are Practical. In: Proc. of 12th Usenix Security Symposium, pp. 1–14 (2003)Google Scholar
- 9.Canvel, B., Hiltgen, A., Vaudenay, S., Vuagnoux, M.: Password Interception in a SSL/TLS Channel. In: Boneh, D. (ed.) CRYPTO 2003. LNCS, vol. 2729, pp. 583–599. Springer, Heidelberg (2003)Google Scholar
- 10.Thomas, S.: SSL and TLS Essentials - Securing the Web. John Wiley & Sons Inc, West Sussex (2000)Google Scholar
- 11.Shirey, R.: Internet Security Glossary, RFC 2828 (May 2000)Google Scholar
- 13.Modadugu, N., Rescorla, E.: The Design and Implementation of Datagram TLS. In: Proceedings of ISOC NDSS 2004, February 2004, San Diego, California (2004)Google Scholar