Does HTTPS provide availability?

Question

The paper On the Security of the TLS Protocol suggests HTTPS provides availability, but I couldn't find the explanation. Is it provided because HTTP supports load balancers etc.? Or is it something special about HTTPS that helps with availability?

Answer 1

The paper On the Security of the TLS Protocol suggests HTTPS provides availability

No, it doesn't.

Quote of the relevant section of the paper:

II. Security Goals

...

The primary goal of TLS, defined in its specification, is “Cryptographic security” [3]. This goal already refers to the Confidentiality corner of the CIA triad. The CIA triad describes the most necessary security goals a secure application has to fulfill in order to provide data security. The following three enumeration items describe the corners of the CIA triad [2].

The paper claims that TLS's first security goal "Cryptographic Security" matches Confidentiality in the CIA triad. The paper doesn't claim that TLS fulfills the other two corner of the triad.

Does HTTPS provide availability?

No it doesn't.

If we refer to RFC 5246, TLS has four goals:

2. Goals

The goals of the TLS protocol, in order of priority, are as follows:

1. Cryptographic security: TLS should be used to establish a secure connection between two parties.
2. Interoperability: Independent programmers should be able to develop applications utilizing TLS that can successfully exchange cryptographic parameters without knowledge of one another's code.
3. Extensibility: TLS seeks to provide a framework into which new public key and bulk encryption methods can be incorporated as necessary. This will also accomplish two sub-goals: preventing the need to create a new protocol (and risking the introduction of possible new weaknesses) and avoiding the need to implement an entire new security library.
4. Relative efficiency: Cryptographic operations tend to be highly CPU intensive, particularly public key operations. For this reason, the TLS protocol has incorporated an optional session caching scheme to reduce the number of connections that need to be established from scratch. Additionally, care has been taken to reduce network activity.

While the paper didn't make a claim about Integrity, TLS together with the associated x509 certificate actually also fulfills the Integrity criteria, provided that you trust the CA system. Confidentiality in TLS is achieved by cryptographic signing and MAC of each packets transferred in the connection, which prevents data traveling through the connection from being altered without being noticed.

TLS doesn't directly improve Availability, although it can improve availability in some scenarios, such as when used with client certificate, a TLS Terminator can be configured to reject unauthenticated/improperly authenticated connections before proxying it to the real server, which could reduce the impact of abuse on a scarce resource on the real server.

Answer 2

If I read the paper correctly, availability in this context just means that TLS does not have any intrinsic properties which limit the availability. It does not mean that using TLS by its own increases the availability because TLS just provides secure transport.

Of course, practical use of TLS might both increase and decrease availability. Increased availability could for example be reached because transport of sensitive data like passwords is protected against sniffing and thus it is harder for an attacker to get the credentials needed to hack into a specific system (which would decrease its availability). Decreased availability can happen because TLS needs more resources for the same traffic load so unless the hardware is adapted accordingly the availability is less than without TLS.