Lecture

Raccoon Attack on TLS 1.2

Graph Chat

Chat with Graph Search

Ask any question about EPFL courses, lectures, exercises, research, news, etc. or try the example questions below.

DISCLAIMER: The Graph Chatbot is not programmed to provide explicit or categorical answers to your questions. Rather, it transforms your questions into API requests that are distributed across the various IT services officially administered by EPFL. Its purpose is solely to collect and recommend relevant references to content that you can explore to help you answer your questions.

In course

COM-506: Seminar on applied cryptography

This seminar introduces the participants to the current trends, problems, and methods in the area of communication security. ...

Description

This lecture delves into the Raccoon Attack, a timing attack on TLS-DH(E) that exploits most significant bit oracles. The instructor explains the TLS protocol, key exchange, HMAC, and the impact of the attack on TLS 1.2. The lecture covers the background of the attack, the use of shared secrets, key derivation functions, and the implications for TLS security. The instructor details how the attack works, the hidden number problem, and the lattice construction used to retrieve premaster secrets. The lecture also discusses the practicality of the attack, the differences between static and ephemeral keys, and the importance of avoiding key reuse in TLS. The instructor concludes by highlighting the lessons learned from the Raccoon Attack and the implications for TLS security.

Instructor

Serge Vaudenay

Serge Vaudenay entered at the Ecole Normale Supérieure in 1989 with a major in mathematics. He earned his agrégation (secondary teaching degree) in mathematics in 1992, then a PhD in Computer Science at the University of Paris 7 - Denis Diderot in 1995. He subsequently became a senior research fellow at the CNRS, prior to being granted his habilitation à diriger des recherches (a postdoctoral degree authorizing the recipient to supervise doctoral students). In 1999, he was appointed as a Professor at the EPFL, where he created the Security and Cryptography Laboratory.

Official source

Ontological neighbourhood

Computer engineering

Computer security: Public-key cryptography

Related concepts (32)

GnuTLS

GnuTLS (ˈɡnuː_ˌtiː_ˌɛl_ˈɛs, the GNU Transport Layer Security Library) is a free software implementation of the TLS, SSL and DTLS protocols. It offers an application programming interface (API) for applications to enable secure communication over the network transport layer, as well as interfaces to access X.509, PKCS #12, OpenPGP and other structures. GnuTLS consists of a library that allows client applications to start secure sessions using the available protocols. It also provides command-line tools, including an X.

Security

Security is protection from, or resilience against, potential harm (or other unwanted coercion) caused by others, by restraining the freedom of others to act. Beneficiaries (technically referents) of security may be of persons and social groups, objects and institutions, ecosystems or any other entity or phenomenon vulnerable to unwanted change. Security mostly refers to protection from hostile forces, but it has a wide range of other senses: for example, as the absence of harm (e.g.

Key management

Key management refers to management of cryptographic keys in a cryptosystem. This includes dealing with the generation, exchange, storage, use, crypto-shredding (destruction) and replacement of keys. It includes cryptographic protocol design, key servers, user procedures, and other relevant protocols. Key management concerns keys at the user level, either between users or systems. This is in contrast to key scheduling, which typically refers to the internal handling of keys within the operation of a cipher.

Computer security

Computer security, cyber security, digital security or information technology security (IT security) is the protection of computer systems and networks from attacks by malicious actors that may result in unauthorized information disclosure, theft of, or damage to hardware, software, or data, as well as from the disruption or misdirection of the services they provide. The field is significant due to the expanded reliance on computer systems, the Internet, and wireless network standards such as Bluetooth and Wi-Fi.

Key (cryptography)

A key in cryptography is a piece of information, usually a string of numbers or letters that are stored in a file, which, when processed through a cryptographic algorithm, can encode or decode cryptographic data. Based on the used method, the key can be different sizes and varieties, but in all cases, the strength of the encryption relies on the security of the key being maintained. A key's security strength is dependent on its algorithm, the size of the key, the generation of the key, and the process of key exchange.

Related lectures (64)

Conditional Access II

Covers conditional access, encryption, decryption, authentication, and advanced encryption standards, exploring identity-based encryption, biometrics, and attribute-based encryption.

Commitment Scheme and PRNG

Explores the commitment scheme, key derivation function, and pseudorandom generator in cryptographic protocols, emphasizing their role in ensuring data integrity and authentication.

Noise Protocol Framework: Building Secure Crypto Protocols

Covers the Noise Protocol Framework for designing secure channel protocols and its applications in real-world cryptography.

Introduction to Cryptography: Fundamentals and Applications

Covers the fundamentals of cryptography, including symmetric encryption, digital signatures, and secure communication standards.

Postquantum TLS: Key Exchange and Authentication