3

I don't know whether it is right to ask a question here for my MTech dissertation. I thought there is no good place in the world where I can find security experts like here.

I am interested in doing research in the protocol SSL/TLS. I know a fair bit of knowledge about protocol and underlying primitives. The first paper I found browsing for research areas and give me more exposure for SSL/TLS protocol is 20 Years of SSL/TLS Research An Analysis of the Internet’s Security Foundation by Cristopher Meyer. It discusses the protocol, popular implementations and attacks in this protocol.

I was interested in doing a survey of security vulnerabilities in the SSL/TLS web servers and exploit some. For this I found a good paper Cryptographic Strength of SSL/TLS Servers: Current and Recent Practices. Basically, I had idea of doing same work related to this paper i.e. finding security vulnerabilities that still exist by scanning a list of web servers. Also, there are online tools like ssllabs. Since, most of the work is being already done here, I want to ask experts which work I can do?

If there are some active research work currently being done on SSL/TLS protocol, I would like to know.

Thank You

Improve this question
8
  • People are currently working on TLS v1.3 which supposedly adds many shiny features (like 0-RTT), improves the security proofs and overhauls some other systems (f.ex. session resumption and anon suites may be replaced by PSK)
    – SEJPM
    Commented Mar 29, 2016 at 18:45
  • Apart from TLS mailing list where can I find information about TLS v1.3
    – prakharjain
    Commented Mar 29, 2016 at 19:12
  • In the official draft?
    – SEJPM
    Commented Mar 29, 2016 at 19:15
  • yes, apart from this where can I find information about TLS v1.3
    – prakharjain
    Commented Mar 29, 2016 at 19:16
  • No, that's not what you were asking. A draft of TLS v1.3 isn't - in itself - a research topic. It could be a good starting point to find one, but a research topic it aint.
    – Maarten Bodewes
    Commented Apr 2, 2016 at 9:48

1 Answer 1

Reset to default
1

The list of open TLS 1.3 issues may give you some ideas. For example:

  • Should SNI be encrypted to hide the server name to passive attackers? The issue states that this will complicate the handshake. Why is this the case? Maybe you can research the best way to implement this.
  • Can the server request a proof of work from the client to prevent DoS attacks? Should this be in TLS?
  • Can the handshake hashes be safely restarted? The issue states this needs "security analysis", maybe you can research that.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .