DMCA
ABSTRACT Cryptographic Strength of SSL/TLS Servers: Current and Recent Practices
Cached
Download Links
| Citations: | 12 - 0 self |
BibTeX
@MISC{Lee_abstractcryptographic,
author = {Homin K. Lee and Erich Nahum},
title = {ABSTRACT Cryptographic Strength of SSL/TLS Servers: Current and Recent Practices},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
The Secure Socket Layer (SSL) and its variant, Transport Layer Security (TLS), are used toward ensuring server security. In this paper, we characterize the cryptographic strength of public servers running SSL/TLS. We present a tool developed for this purpose, the Probing SSL Security Tool (PSST), and evaluate over 19,000 servers. We expose the great diversity in the levels of cryptographic strength that is supported on the Internet. Some of our discouraging results show that most sites still support the insecure SSL 2.0, weak export-level grades of encryption ciphers, or weak RSA key strengths. We also observe encouraging behavior such as sensible default choices by servers when presented with multiple options, the quick adoption of AES (more than half the servers support strong key AES as their default choice), and the use of strong RSA key sizes of 1024 bits and above. Comparing results of running our tool over the last two years points to a positive trend that is moving in the right direction, though perhaps not as quickly as it should.
Keyphrases
recent practice abstract cryptographic strength ssl tl server cryptographic strength encryption cipher default choice weak rsa key strength ssl tl year point secure socket layer public server insecure ssl server security quick adoption transport layer security weak export-level grade strong key aes probing ssl security tool strong rsa key size multiple option positive trend sensible default choice great diversity right direction
