SSL/TLS Security and Implementation

  1. Security Vulnerabilities
    1. Protocol-Level Attacks
      1. Downgrade Attacks
        1. Protocol Version Downgrade
          1. Cipher Suite Downgrade
            1. POODLE Attack
              1. SSL 3.0 Padding Oracle
                1. Mitigation Strategies
              2. Man-in-the-Middle Attacks
                1. SSL Stripping
                  1. Certificate Substitution
                    1. Rogue Certificate Authorities
                  2. Implementation Vulnerabilities
                    1. Heartbleed Vulnerability
                      1. OpenSSL Memory Disclosure
                        1. Impact Assessment
                          1. Mitigation Measures
                          2. Apple goto fail Bug
                            1. Signature Verification Bypass
                              1. Code Quality Issues
                            2. Cryptographic Attacks
                              1. Block Cipher Attacks
                                1. BEAST Attack
                                  1. CBC Mode Exploitation
                                    1. Browser Mitigation
                                    2. Lucky 13 Attack
                                      1. Timing Side Channel
                                        1. Padding Oracle Variant
                                      2. Compression Attacks
                                        1. CRIME Attack
                                          1. TLS Compression Exploitation
                                          2. BREACH Attack
                                            1. HTTP Compression Exploitation
                                          3. Key Exchange Attacks
                                            1. Logjam Attack
                                              1. Weak Diffie-Hellman Parameters
                                              2. FREAK Attack
                                                1. Export-Grade RSA Exploitation
                                            2. Side-Channel Attacks
                                              1. Timing Attacks
                                                1. Cryptographic Operation Timing
                                                  1. Statistical Analysis
                                                  2. Power Analysis Attacks
                                                    1. Simple Power Analysis
                                                      1. Differential Power Analysis
                                                      2. Cache-Based Attacks
                                                        1. Cache Timing Attacks
                                                          1. Flush+Reload Attacks

                                                      Previous

                                                      6. Server Implementation

                                                      Go to top

                                                      Next

                                                      8. Security Best Practices