Elaphurus: Ensemble Defense Against Fraudulent Certificates in TLS

  • Bingyu Li
  • , Wei Wang*
  • , Lingjia Meng
  • , Jingqiang Lin
  • , Xuezhong Liu
  • , Congli Wang
  • *Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

Recent security incidents indicate that certificate authorities (CAs) might be compromised to sign certificates with fraudulent information. The fraudulent certificates are exploited to launch successful TLS man-in-the-middle (MitM) attacks, even when TLS clients strictly verify the server certificates. Various security-enhanced certificate verification schemes have been proposed to defend against fraudulent certificates, such as Pinning, CAge, CT, DANE, and DoubleCheck. However, none of the above schemes perfectly solves the problem, which hinders them from being widely deployed. This paper analyzes these schemes in terms of security, usability and performance. Based on the analysis, we propose Elaphurus, an integrated security-enhanced certificate verification scheme on the TLS client side. Elaphurus is designed on top of Pinning, while integrating other schemes to eliminate their disadvantages and improving the overall security and usability. We implement the prototype system with OpenSSL. Experimental results show that it introduces a reasonable overhead, while effectively enhancing the security of certificate verification.

Original languageEnglish
Title of host publicationInformation Security and Cryptology - 15th International Conference, Inscrypt 2019, Revised Selected Papers
EditorsZhe Liu, Moti Yung
PublisherSpringer
Pages246-259
Number of pages14
ISBN (Print)9783030429201
DOIs
StatePublished - 2020
Externally publishedYes
Event15th International Conference on Information Security and Cryptology, Inscrypt 2019 - Nanjing, China
Duration: 6 Dec 20198 Dec 2019

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume12020 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

Conference15th International Conference on Information Security and Cryptology, Inscrypt 2019
Country/TerritoryChina
CityNanjing
Period6/12/198/12/19

Keywords

  • Certificate
  • Certificate transparency (CT)
  • DNS-based authentication of named entities (DANE)
  • Pinning
  • TLS

Fingerprint

Dive into the research topics of 'Elaphurus: Ensemble Defense Against Fraudulent Certificates in TLS'. Together they form a unique fingerprint.

Cite this