CWI Cryptology Group

Abstract: TLS is the de facto protocol of choice for securing Internet communications, while DTLS is an increasingly important variant of TLS that was designed for use in lightweight applications. In this talk, I will provide an overview of what is known about the security of the TLS and DTLS protocols. I'll discuss the BEAST attack on TLS and what its implications are. I'll also talk about a recently discovered vulnerability in TLS 1.2, as well as what we know about the provable security of the protocol. I'll then explain how and why DTLS implementations turn out to be more vulnerable than TLS to padding oracle attacks. The talk will assume knowledge of basic cryptography and networking, but will be as self-contained as possible.