15 ms·
Announcing SSL Labs Grading Changes for 2017
- wolf550e 10y agoWhy does the grade not depend on presence of Certificate Transparency Signed Certificate Timestamp for the certificate, either embedded in the certificate or provided by TLS extension? Google Chrome requires SCTs for all EV certificates and for all certificates issued by Symantec-owned CAs and will require it for all certificates issued after October 2017. Currently the Qualys tester checks for Certificate Transparency, but the grade does not depend on it.
- tptacek 10y agoThat would be a grade at how well your site contributes to the ecosystem, but not as much how safe your particular site was.
- xoa 10y agoIt may just be that they're waiting on more consensus from browser/OS makers and will take a stronger look at this next year as Chrome's (and perhaps Firefox/Safari/IE by that point) general SCT deadline approaches. That said, honest question: are certificate authentication questions really within the strict scope of their focus on SSL? The items they grade is pretty bread-and-butter technical compliance and best practices stuff, within the direct control of a single party (the server owner) and independent of any others. It's pretty unambiguous despite any difficult subject choices that may arise from old infrastructure/client issues. Further, there's also the fact that in all this SSL Labs has grown to fill an important unfilled niche in evaluation. By their nature though CA evaluation and choices are a lot mushier and involve more politics and human factors (witness the recent debates surrounding certificate transparency and how it interacts with internal service usage, vis-a-vis redaction etc). And fundamentally, there are also a lot of powerful, interested actors deeply involved already. Authentication is just a separate domain from the crypto itself, and involves a different set of hairy issues.
- gcp 10y agoWhat's the feeling on them preferring 256-bit AES over 128-bit AES? I was under the impression there is no theoretical nor practical justification for it.
- agwa 10y agoBatch attacks: https://blog.cr.yp.to/20151120-batchattacks.html https://blog.cr.yp.to/20151120-batchattacks.html
- tptacek 10y agoHow is this attack meaningful with the random AES keys generated by the TLS KDF?
- agwa 10y agoHuh? That attack works with random keys. Are you confusing it with a related-key attack?
- tptacek 10y agoLook again. I think the meaningful attacks here are against public key algorithms (and, I suppose, maybe, MAC algorithms). See, for instance, the hypothesized 2^64 ECC attack.
- agwa 10y agoI think this is the essential paragraph: > What the attacker hopes to find inside the AES attack is a key collision. This means that a key guessed by the attack matches a key chosen by a user. Any particular guessed key has chance only 1/2^128 of matching any particular user key, but the attack ends up merging costs across a batch of 2^40 user keys, amplifying the effectiveness of each guess by a factor 2^40 If the attacker has collected 2^40 instances of some known plaintext, such as "GET / HTTP/1.1\r\n", encrypted under 2^40 unknown AES-128 keys (and it doesn't matter how those keys were generated), then the attacker can generate a key randomly, encrypt the known plaintext under that key, and see if it matches any of the target ciphertexts. The chance of guessing one of the 2^40 keys successfully this way is 1/2^(128-40) = 1/2^88. This means that attacking one of the keys requires far less than the 2^128 operations that one might expect would be required to attack AES-128. DJB argues that this makes AES-128 ill-matched with elliptic curves that provide a 128-bit security level, thus motivating a cipher with 256 bit keys instead, such as AES-256 or ChaCha20. In practice, the first 32 bits of the GCM nonce used by TLS are derived during the handshake, so the attacker has to do 2^32 more computations (since there are 2^32 different ways a known plaintext could be encrypted with a given key). So perhaps AES-128 is actually fine with TLS. But the point still stands that there is a justification for preferring AES-256 over AES-128.
- kseistrup 10y agoIt would be nice with an SSL Labs Beta site that let you test your site(s) according to the upcoming grading rules.
- yuhong 10y agohttps://dev.ssllabs.com/ https://dev.ssllabs.com/
- kseistrup 10y agoThanks for the link! I'm not sure it does thing differently, though. I'll have to check it again later.
- deleted 10y ago[deleted]
- peterkshultz 10y agoI think different tests are being run based on the version numbers: the dev test is v1.25.2, whereas the production version is v1.24.4
- mattbillenstein 10y agoAnd what would be really really rad would be open-sourcing the toolkit that makes these checks possible -- I'd like to plug something like that into periodic checks in nagios or something.
- ivanr 10y agoIf your servers are all public, you can use the (also free) SSL Labs API: https://www.ssllabs.com/projects/ssllabs-apis/ https://www.ssllabs.com/projects/ssllabs-apis/
- mattbillenstein 10y agoSweet -- next best thing -- thanks! !
- meta_AU 10y agoI like how informal systems like this drive feature development in reverse proxies. Nginx has great support for automated OSCP now, but I wonder if that would have come to pass without some group saying it is important and giving it a (somewhat arbitrary) rating.
- Panino 10y agoAll good changes. I'd also like to see the Handshake Simulation improved by splitting ancient clients out into their own section. Call it Obsolete or Legacy. Populate it with all the clients that don't support ECDHE or TLS 1.2. With that change, people won't feel pressured to support IE6 on Windows XP or other such combos. In the real world, a big majority of TLS 1.0 traffic is either 1) unknown web crawlers that don't matter, or 2) zombies running on ancient hacked machines looking to replicate. It's mostly unwanted traffic. You might say it does no harm to enable connections to IE6 on Windows XP, but I can think of two reasons why it does: First, enabling more ciphersuites in OpenSSL (or other) increases your attack surface, and as for me, I'm way more interested in reducing my attack surface than in talking to a computer that was last updated in 2001. Second, these XP machines will hang around the Internet so long as they're useful. We cancel the driving priveleges of drunk and senile people, and we should do the same at the protocol level for XP machines. And anyway, it's incoherent to mark an IE6/XP connection failure in red (which means bad), while simultaneosly saying that SSL3 is bad. Some cruft has built up over the years, and it needs to be periodically removed.
- deleted 10y ago[deleted]
- josho 10y agoEveryone should note that they intend the following change: > HSTS preloading required for A+ So, if this vanity metric is important for you, you may want to start thinking about getting yourself added, https://hstspreload.appspot.com https://hstspreload.appspot.com
- captn3m0 10y agoThe preload pre-conditions are what stops us from considering it: - Must be on the root domain. - Must redirect HTTP to HTTPS. We refuse to serve content over HTTP, and thus don't redirect broken clients. Doesn't make sense to penalize people for not being on the list.
- bradknowles 10y agoWith respect, I disagree that anyone should make it easier to get an A+ rating. That really should be reserved for the best of the best, where a site implements all current best practices and avoids all current weaknesses. An A+ grade should be hard to get, and really mean something.
- mkj 10y agoNo, sites would be better off spending that extra effort on non-cryptographic security like protecting their DNS registration, internal spearphishing, etc.
- bradknowles 10y agoIMO, full cryptographic security should be the baseline. Yes, you need the other things too, but until you've got full current cryptographic security, you're simply not done in that area.
- mkj 10y agoWhat's an example of something they could add that would make A+ harder to get, and also add meaningful security?
- bradknowles 10y agoIMO, full cryptographic security should be the baseline. Yes, you need the other things too, but until you've got full current cryptographic security, you're simply not done in that area.
- darklajid 10y agoNo, it shouldn't be hard to get and it already does mean something. You seem to think of grades as in 'honorifics' or something. "The best of the crop are assigned an A+ to distinguish them from the rest". But that's not what we have here. SSL Labs grades aren't "rare". They're a supposed to be a direct result of your TLS deployment practices. Given that everyone should follow best practices, everyone should aim for (and get) an A+ in an ideal world.