The Era of TLS 1.3: Measuring Deployment and Use Ralph Holz The - - PowerPoint PPT Presentation
The Era of TLS 1.3: Measuring Deployment and Use Ralph Holz The University of Sydney Johanna Amann ICSI / Corelight / LBL Abbas Razaghpanah Stony Brook University Jens Hiller RWTH Aachen Thomas Jost RWTH Aachen Oliver
The Era of TLS 1.3: Measuring Deployment and Use
Ralph Holz Johanna Amann Abbas Razaghpanah Jens Hiller Thomas Jost Oliver Hohlfeld Narseo Vallina-Rodriguez The University of Sydney ICSI / Corelight / LBL Stony Brook University RWTH Aachen RWTH Aachen Brandenburg University of Technology IMDEA Networks Institute / ICSI
Real World Crypto (RWC) 2020 Perspectives
Active Scans Passive measurements Android ecosystem measurements
Active Scans
Android dataset: Lumen
Passive dataset: ICSI SSL Notary
ICSI Notary
Internet Internal Network Zeek Network Monitor Database Outgoing SSL/TLS Sessions Data Provider Collector
The Zeek (Bro) Platform
8Network
Programming Language Packet Processing Standard Library
Platform
Vulnerabilit. Mgmt Intrusion Detection File Analysis Compliance Monitoring Traffic Measure- ment Traffic ControlApps Tap
Open Source BSD License
Notary - Collected features
Available ciphers Timestamp Version Analyzer Error Packet loss Hash(client session ID) Client & Server TLS extensions Selected cipher Hash(client IP , server IP) Content length Server certificates Hash(server session ID) Connection history Server IP Ticket lifetime hint Duration Server Name Indication Client EC curve Client EC point formats DH parameter size Number Client Certs Send & received bytes Client & Server ALPN TLS Alerts
Notary - Connections
Notary - Certificates
20,000,000 40,000,000 60,000,000 80,000,000 100,000,000 120,000,000 140,000,000 160,000,000 180,000,000 200,000,000 220,000,000 2012−01−01 2012−04−01 2012−07−01 2012−10−01 2013−01−01 2013−04−01 2013−07−01 2013−10−01 2014−01−01 2014−04−01 2014−07−01 2014−10−01 2015−01−01 2015−04−01 2015−07−01 2015−10−01 2016−01−01 2016−04−01 2016−07−01 2016−10−01 2017−01−01 2017−04−01 2017−07−01 2017−10−01 2018−01−01 2018−04−01 2018−07−01 2018−10−01 2019−01−01 2019−04−01 2019−07−01 2019−10−01 Time Number of certificates Server Support - Alexa
21 22 23 24 28 RFC 18 22 23 RFC TLSv1.3draft18 TLSv1.3draft19 TLSv1.3draft21 TLSv1.3draft22 TLSv1.3draft23 TLSv1.3draft26 TLSv1.3draft28 TLSv1.3
Server Support - CNO
21 22 23 24 28 RFC 18 22 23 RFC TLSv1.3draft18 TLSv1.3draft19 TLSv1.3draft21 TLSv1.3draft22 TLSv1.3draft23 TLSv1.3draft26 TLSv1.3draft28 TLSv1.3
Server Support - Not CNO
21 22 23 24 28 RFC 18 22 23 RFC TLSv1.3draft18 TLSv1.3draft19 TLSv1.3draft21 TLSv1.3draft22 TLSv1.3draft23 TLSv1.3draft26 TLSv1.3draft28 TLSv1.3
Server Support - Cloudflare
21 22 23 24 28 RFC 18 22 23 RFC TLSv1.3draft18 TLSv1.3draft22 TLSv1.3draft23 TLSv1.3
Server Support - Facebook
21 22 23 24 28 RFC 18 22 23 RFC TLSv1.3draft18 TLSv1.3draft22 TLSv1.3draft23 TLSv1.3
Server Support - Digitalocean
21 22 23 24 28 RFC 18 22 23 RFC TLSv1.3draft18 TLSv1.3draft19 TLSv1.3draft21 TLSv1.3draft22 TLSv1.3draft23 TLSv1.3draft28 TLSv1.3
Server Support - Domains
Alexa ccTLD cno gTLD 05/19 06/19 07/19 08/19 10/19 11/19 05/19 06/19 07/19 08/19 10/19 11/19 05/19 06/19 07/19 08/19 10/19 11/19 05/19 06/19 07/19 08/19 10/19 11/19 25 50 75 100
Time pct version
TLSError TLSpre1.2 TLSv1.2 TLSv1.3
Server Support - IPs
Alexa ccTLD cno gTLD 05/19 06/19 07/19 08/19 10/19 11/19 05/19 06/19 07/19 08/19 10/19 11/19 05/19 06/19 07/19 08/19 10/19 11/19 05/19 06/19 07/19 08/19 10/19 11/19 25 50 75 100
Time pct version
TLSError TLSpre1.2 TLSv1.2 TLSv1.3
Negotiated Versions
10 20 30 40 50 60 70 80 90 100 2012−05−01 2012−11−01 2013−05−01 2013−11−01 2014−05−01 2014−11−01 2015−05−01 2015−11−01 2016−05−01 2016−11−01 2017−05−01 2017−11−01 2018−05−01 2018−11−01 2019−05−01 2019−11−01
Percent connections per month Version
TLSv10 TLSv11 TLSv12 TLSv13
Client Offered
5 10 15 20 25 30 35 40 45 50 55 60 2016−09−01 2016−11−01 2017−01−01 2017−03−01 2017−05−01 2017−07−01 2017−09−01 2017−11−01 2018−01−01 2018−03−01 2018−05−01 2018−07−01 2018−09−01 2018−11−01 2019−01−01 2019−03−01 2019−05−01 2019−07−01 2019−09−01 2019−11−01
Percent connections/month
Client Offered
5 10 15 20 25 30 35 40 45 50 55 60 2016−09−01 2016−11−01 2017−01−01 2017−03−01 2017−05−01 2017−07−01 2017−09−01 2017−11−01 2018−01−01 2018−03−01 2018−05−01 2018−07−01 2018−09−01 2018−11−01 2019−01−01 2019−03−01 2019−05−01 2019−07−01 2019−09−01 2019−11−01
Percent connections/month
Client Offered
5 10 15 20 25 30 35 40 45 50 55 60 2016−09−01 2016−11−01 2017−01−01 2017−03−01 2017−05−01 2017−07−01 2017−09−01 2017−11−01 2018−01−01 2018−03−01 2018−05−01 2018−07−01 2018−09−01 2018−11−01 2019−01−01 2019−03−01 2019−05−01 2019−07−01 2019−09−01 2019−11−01
Percent connections/month
Most clients also advertise older versions in ext: 93.4% TLS 1.0 93.4% TLS 1.1 94.2% TLS 1.2 Offered/negotiated versions
November 2019 Selected Ciphers (TLS1.3)
November 2019TLS_AES_128_GCM_SHA256 73.4% TLS_AES_256_GCM_SHA384 17.6% TLS_CHACHA20_POLY1305_SHA25 6 9.0%
Selected Ciphers (All)
November 2019TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 40.2% TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 18.9% TLS_AES_128_GCM_SHA256 14.5% TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 8.1% TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 4.1% TLS_AES_256_GCM_SHA384 3.1% TLS_CHACHA20_POLY1305_SHA256 1.8% TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 1.5%
Extensions
November 2019Pre-shared key (client): 11.2% In 89% of cases, the server also replies with a PSK extension. Early-data (client): 4.3% of all connections (34.1% of PSK connections) Hello retry-request: ~4% of connections (April) Certificate compression (client): 42.7%
Connections to different providers
https://arxiv.org/abs/1907.12762 April 2019 Australia
https://arxiv.org/abs/1907.12762 April 2019 Android negotiated versions
25 50 75 100 2017−02−01 2017−03−01 2017−04−01 2017−05−01 2017−06−01 2017−07−01 2017−08−01 2017−09−01 2017−10−01 2017−11−01 2017−12−01 2018−01−01 2018−02−01 2018−03−01 2018−04−01 2018−05−01 2018−06−01 2018−07−01 2018−08−01 2018−09−01 2018−10−01 2018−11−01 2018−12−01 2019−01−01 2019−02−01 2019−03−01 2019−04−01 2019−05−01 2019−06−01 2019−07−01 2019−08−01 2019−09−01 2019−10−01
Month Percent connections/month
7E02 Draft 18 Draft 22aft 18 aft 22 Draft 23 Draft 26 Draft 28 aft 23 aft 26 aft 28 Facebook 20 Facebook 22 Facebook 23 acebook 20 acebook 22 acebook 23 Facebook 26 Final Standard 7E02 Draft 18 Draft 22
Summary