Classification of SSL servers based on their SSL handshake for automated security assessment

Sirikarn Pukkawanna (1) , Youki Kadobayashi (1) , Gregory Blanc (2, 3, 4) , Joaquin Garcia-Alfaro (5, 2, 3, 4) , Hervé Debar (5, 2, 3, 4)

1 NAIST - Nara Institute of Science and Technology - Graduate School of Information Science
2 TSP - RST - Département Réseaux et Services de Télécommunications
3 SAMOVAR - Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux
4 CNRS - Centre National de la Recherche Scientifique
5 R3S-SAMOVAR - Réseaux, Systèmes, Services, Sécurité

The Secure Socket Layer (SSL) and Transport Layer Security (TLS) are the most widely deployed security protocols used in systems required to secure information such as online banking. In this paper, we propose three handshakeinformation- based methods for classifying SSL/TLS servers in terms of security: (1) Distinguished Names-based, (2) protocol version and encryption algorithm-based, and (3) combined vulnerability score-based methods. We also classified real-world SSL/TLS servers, active during July 2010 to May 2011, using the proposed methods. Finally, we propose 45 features, deemed relevant to security assessment, for future SSL/TLS data collection. The classification results showed that servers had bimodal distribution, with mostly good and bad levels of security. The results also showed that the majority of the SSL/TLS servers had seemingly risky certificates, and used both risky protocol versions and encryption algorithms

Mots clés: Secure Socket Layer; Computer Security; Network Security

Domaines: Cryptographie et sécurité [cs.CR]

Sirikarn Pukkawanna, Youki Kadobayashi, Gregory Blanc, Joaquin Garcia-Alfaro, Hervé Debar. Classification of SSL servers based on their SSL handshake for automated security assessment. BADGERS 2014 : 3rd International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, Sep 2014, Wroclaw, Poland. pp.30 - 39, ⟨10.1109/BADGERS.2014.10⟩. ⟨hal-01332339⟩