Lies and the Lying Liars that Tell Them: A Fair and Balanced Look at TLS

摘要

The secure sockets layer (SSL), later modified to become transport layer security (TLS), has become the basis of many aspects of Internet security. The vast majority of e-commerce sites use TLS to protect consumers. Within the past year, a number of TLS weaknesses have become apparent. These weaknesses are due to problems in the domain name system (DNS), problems with certificate distribution, browser programming errors, usability issues, and advances in cryptanalysis. While the basic SSL/TLS protocol is not compromised by any of these security failures, the result is that current e-commerce implementations are severely flawed. This provides a number of important lessons for designing, implementing and deploying trusted systems.