Abstract
HSTS and HPKP are relatively recent protocols aimed to enforce HTTPS connections and allow certificate pinning over HTTP. The combination of these protocols improves and strengthens HTTPS security in general, adding an additional layer of trust and verification, as well as ensuring as far as possible that the connection is always secure. However, the adoption and implementation of any protocol that is not yet completely settled, usually involves the possibility of introducing new weaknesses, opportunities or attack scenarios. Even when these protocols are implemented, bad practices prevent them from actually providing the additional security they are expected to provide. In this document, we have studied the quantity and the quality of the implementation both in servers and in most popular browsers and discovered some possible attack scenarios.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsReferences
Rizzo, J., Duong, T.: BEAST. Ekoparty (2011)
Mller, B., Duong, T., Kotowicz, K.: This POODLE bites: exploiting the SSL 3.0 fallback (2014). https://www.openssl.org/~bodo/ssl-poodle.pdf. REPASAR
Rizzo, J., Duong, T.: The CRIME Attack. Ekoparty (2012)
Codenomicon: The Heartbleed Bug. Ekoparty (2014)
Bhargavan, K., Delignat-Lavaud, A., Fournet, C., Pironti, A., Strub, P.: Triple handshakes and cookie cutters: breaking and fixing authentication over TLS. In: IEEE Symposium on Security and Privacy (2014)
Jia, Y., Chen, Y., Dong, X., Saxena, P., Mao, J., Liang, Z.: Man-in-the-browser-cache: persisting HTTPS attacks via browser cache poisoning. Comput. Secur. 55, 62–80 (2015)
Marlinspike, M.: New Tricks for Defeating SSL in Practice. BlackHat (2009). http://www.thoughtcrime.org/software/sslstrip/
Paul, I.: Firefox Add-on Firesheep Brings Hacking to the Masses. PCWorld (2010)
Mandalia, R.: Security Breach in CA Networks - Comodo, DigiNotar, GlobalSign. \(ISC^2\) Blog (2012). http://blog.isc2.org/isc2_blog/2012/04/test.html
Langley, A.: Further improving digital certificate security. Google Security Blog (2013). https://security.googleblog.com/2013/12/further-improving-digital-certificate.html
Langley, A.: Maintaining digital certificate security. Google Security Blog (2014). https://security.googleblog.com/2014/07/maintaining-digital-certificate-security.html
Hoffman, P.: The DNS-Based Authentication of Named Entities (DANE). Transport Layer Security (TLS) Protocol: TLSA. https://www.rfc-editor.org/rfc/rfc6698.txt
Marlinspike, M., Perrin, T.: Tacks. http://tack.io/draft.html
Loesch, C.: Certificate Patrol. https://addons.mozilla.org/es/firefox/addon/certificate-patrol/
Wendlandt, D., Andersen, D., Perrig, A.: Perspectives: Improving SSH-style Host Authentication with Multi-Path Probing (2008). http://static.usenix.org/event/usenix08/tech/full_papers/wendlandt/wendlandt_html/
Marlinspike, M.: Convergence (2011). http://convergence.io/
Yan: Weird New Tricks for Browser Fingerprinting (2015). https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf
Internet Engineering Task Force (IETF): HTTP Strict Transport Security (HSTS). RFC 6797(2012). https://tools.ietf.org/html/rfc6797
Internet Engineering Task Force (IETF): Public Key Pinning Extension for HTTP. RFC 7469(2015). https://tools.ietf.org/html/rfc7469
Internet Engineering Task Force (IETF): Certificate Transparency (2013). https://tools.ietf.org/html/rfc6962
Garron, L., Bortz, A., Boneh, D.: The State of HSTS Deployment: A Survey and Common Pitfalls (2014)
Kranch, M., Bonneau, J.: Upgrading HTTPS in mid-air: an empirical study of strict transport security and key pinning. In: Network and Distributed System Security Symposium (NDSS) (2015)
Selvi, J.: Bypassing HTTP Strict Transport Security. BlackHat Europe (2014)
IETF: IETF. https://www.ietf.org/
Shodan: Shodan. http://www.shodan.io
Alexa internet Inc: Alexa. http://www.alexa.com/
Deveria, A.: Can I use Strict Transport Security? (2016). http://caniuse.com/#feat=stricttransportsecurity
Monica: Firefox 32 supports Public Key Pinning (2014). http://monica-at-mozilla.blogspot.de/2014/08/firefox-32-supports-public-key-pinning.html
Bugzilla: Bugzilla@Mozilla (2014). https://bugzilla.mozilla.org/show_bug.cgi?id=775370
Mozilla: Mozilla Code (2014). https://dxr.mozilla.org/comm-central/source/mozilla/security/manager/ssl/nsSiteSecurityService.h
ElevenPaths: PinPatro. https://addons.mozilla.org/es/firefox/addon/pinpatrol/
Deveria, A.: Can I Use Public Key Pinning (2015). http://caniuse.com/#feat=publickeypinning
Deveria, A.: Can I use HSTS? (2015). http://caniuse.com/#search=HSTS
Nishimura, M.: Appended period to hostnames can bypass HPKP and HSTS protections. https://www.mozilla.org/en-US/security/advisories/mfsa2015-13/
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2016 Springer International Publishing AG
About this paper
Cite this paper
de los Santos, S., Torrano, C., Rubio, Y., Brezo, F. (2016). Implementation State of HSTS and HPKP in Both Browsers and Servers. In: Foresti, S., Persiano, G. (eds) Cryptology and Network Security. CANS 2016. Lecture Notes in Computer Science(), vol 10052. Springer, Cham. https://doi.org/10.1007/978-3-319-48965-0_12
Download citation
DOI: https://doi.org/10.1007/978-3-319-48965-0_12
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-48964-3
Online ISBN: 978-3-319-48965-0
eBook Packages: Computer ScienceComputer Science (R0)