Links: Bulletproof SSL and TLS

Below are all the links from the book Bulletproof SSL and TLS. We occasionally run through the entire list to check and fix broken entries. As a result, the links here might not be exactly the same as the ones in the earlier digital releases.

1. SSL, TLS, and Cryptography

• TLS Working Group b1

  https://datatracker.ietf.org/wg/tls/documents/
• Security Standards and Name Changes in the Browser Wars b2

  http://tim.dierks.org/2014/05/security-standards-and-name-changes-in.html
• Scytale b4

  https://en.wikipedia.org/wiki/Scytale
• Alice and Bob b5

  https://en.wikipedia.org/wiki/Alice_and_Bob
• Security's inseparable couple b6

  http://www.networkworld.com/article/2318241/lan-wan/security-s-inseparable-couple.html
• la cryptographie militaire b7

  http://petitcolas.net/kerckhoffs/
• RC4 b8

  https://en.wikipedia.org/wiki/RC4
• eSTREAM: the ECRYPT Stream Cipher Project b9

  http://www.ecrypt.eu.org/stream/
• Transparency Report b625

  https://www.google.com/transparencyreport/
• Algorithms, Key Sizes and Parameters Report b523

  https://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-size-and-parameters-report-2014
• Alice and Bob b522

  https://en.wikipedia.org/wiki/Alice_and_Bob
• Universal security; from bits and mips to pools, lakes—and beyond b643

  https://eprint.iacr.org/2013/635
• Scytale b521

  https://en.wikipedia.org/wiki/Scytale
• Advanced Encryption Standard b10

  https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
• Birthday problem b11

  https://en.wikipedia.org/wiki/Birthday_problem
• ECRYPT2 Yearly Report on Algorithms and Keysizes b14

  http://www.ecrypt.eu.org/
• RSA b13

  https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29
• Recommended cryptographic measures - Securing personal data b16

  https://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/recommended-cryptographic-measures-securing-personal-data
• Algorithms, Key Sizes and Parameters Report b15

  https://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-sizes-and-parameters-report
• NIST Special Publication 800-57: Recommendation for Key Management – Part 1: General, Revision 3 b18

  http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf
• BlueKrypt: Cryptographic Key Length Recommendation b17

  https://www.keylength.com/
• The Creepy, Long-Standing Practice of Undersea Cable Tapping b19

  http://www.theatlantic.com/international/archive/2013/07/the-creepy-long-standing-practice-of-undersea-cable-tapping/277855/
• New Details About NSA’s Collaborative Relationships With America’s Biggest Telecom Companies From Snowden Docs b20

  http://www.matthewaid.com/post/59765378513/new-details-about-nsas-collaborative
• RFC 7258: Pervasive Monitoring Is an Attack b23

  http://tools.ietf.org/html/rfc7258
• GCHQ taps fibre-optic cables for secret access to world's communications b22

  http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa
• Transparency Report: Email encryption in transit b25

  https://www.google.com/transparencyreport/saferemail/
• Lavabit b24

  https://en.wikipedia.org/wiki/Lavabit
• Attacking Tor: How the NSA Targets Users' Online Anonymity b27

  https://www.schneier.com/essays/archives/2013/10/attacking_tor_how_th.html
• A Syrian Man-In-The-Middle Attack against Facebook b26

  https://www.eff.org/deeplinks/2011/05/syrian-man-middle-against-facebook

2. Protocol

• TLS working group mailing list archives b3

  http://www.ietf.org/mail-archive/web/tls/current/
• A TLS padding extension b528

  https://datatracker.ietf.org/doc/rfc7685/
• The ChaCha20-Poly1305 AEAD Cipher for TLS b527

  https://datatracker.ietf.org/doc/rfc7905/
• Curve25519 and Curve448 for TLS b529

  https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/
• Wireshark b524

  https://www.wireshark.org/
• RFC 7366: Encrypt-then-MAC for TLS and DTLS b526

  https://datatracker.ietf.org/doc/rfc7366/
• Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for TLS b525

  https://datatracker.ietf.org/doc/draft-ietf-tls-negotiated-ff-dhe/
• TLS working group documents b29

  https://datatracker.ietf.org/wg/tls/documents/
• RFC 5246: The Transport Layer Security Protocol Version 1.2 b28

  http://tools.ietf.org/html/rfc5246
• Deprecating gmt_unix_time in TLS b30

  http://tools.ietf.org/id/draft-mathewson-no-gmtunixtime-00.txt
• The Alert attack b32

  https://www.mitls.org/pages/attacks/Alert
• RFC 5081: Using OpenPGP Keys for TLS Authentication b31

  http://tools.ietf.org/html/rfc5081
• Diffie–Hellman key exchange b34

  https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange
• RFC 3447: RSA Cryptography Specifications Version 2.1 b33

  http://tools.ietf.org/html/rfc3447
• Negotiated Discrete Log Diffie-Hellman Ephemeral Parameters for TLS b36

  https://datatracker.ietf.org/doc/draft-gillmor-tls-negotiated-dl-dhe/
• Public Key Cryptography: Diffie-Hellman Key Exchange b35

  https://www.youtube.com/watch?v=3QnD2c4Xovk
• Tor Protocol Specification b38

  https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt
• TLS Parameters b39

  https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml
• A TLS padding extension b41

  https://datatracker.ietf.org/doc/draft-agl-tls-padding/
• TLS Extensions b40

  https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
• Certificate Transparency b43

  http://www.certificate-transparency.org
• RFC 7301: TLS Application-Layer Protocol Negotiation Extension b42

  http://tools.ietf.org/html/rfc7301
• FIPS 186-3: Digital Signature Standard b45

  http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf
• RFC 4492: ECC Cipher Suites for TLS b44

  http://tools.ietf.org/html/rfc4492
• A state-of-the-art Diffie-Hellman function b47

  http://cr.yp.to/ecdh.html
• RFC 7072: ECC Brainpool Curves for TLS b46

  http://tools.ietf.org/html/rfc7027
• RFC 6520: TLS and DTLS Heartbeat Extension b49

  https://tools.ietf.org/html/rfc6520
• SafeCurves: choosing safe curves for elliptic-curve cryptography b48

  http://safecurves.cr.yp.to/
• SPDY b50

  https://en.wikipedia.org/wiki/SPDY
• Next Protocol Negotiation 03 b52

  http://www.ietf.org/mail-archive/web/tls/current/msg08678.html
• Google Technical Note: TLS Next Protocol Negotiation Extension b51

  https://web.archive.org/web/20150529234248/https://technotes.googlecode.com/git/nextprotoneg.html
• NPN and ALPN b54

  https://www.imperialviolet.org/2013/03/20/alpn.html
• Some missing context (was: Confirming consensus for ALPN) b53

  http://www.ietf.org/mail-archive/web/tls/current/msg09344.html
• RFC 5077: TLS Session Resumption without Server-Side State b56

  http://tools.ietf.org/html/rfc5077
• RFC 6066: TLS Extensions: Extension Definitions b55

  http://tools.ietf.org/html/rfc6066
• Analysis of the SSL 3.0 protocol b58

  https://www.schneier.com/cryptography/paperfiles/paper-ssl-revised.pdf
• RFC 6961: TLS Multiple Certificate Status Request Extension b57

  http://tools.ietf.org/html/rfc6961
• Fortezza b59

  https://en.wikipedia.org/wiki/Fortezza

3. Public-Key Infrastructure

• Analysis of the HTTPS Certificate Ecosystem b518

  http://conferences.sigcomm.org/imc/2013/papers/imc257-durumericAemb.pdf
• Certificate Transparency in Chrome - Change to Enforcement Date b635

  https://groups.google.com/a/chromium.org/forum/#!msg/ct-policy/sz_3W_xKBNY/6jq2ghJXBAAJ
• Censys b627

  https://censys.io
• crt.sh b626

  https://crt.sh/
• RFC 6844: DNS CAA Resource Record b628

  https://tools.ietf.org/html/rfc6844
• Bug #1156844 - Turn off Trust bits for Equifax Secure Certificate Authority 1024-bit root certificate b530

  https://bugzilla.mozilla.org/show_bug.cgi?id=1156844
• TACK b100

  http://tack.io/
• RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile b61

  http://tools.ietf.org/html/rfc5280
• PKIX Working Group b60

  https://datatracker.ietf.org/wg/pkix/charter/
• CA/Browser Forum b62

  https://cabforum.org/
• Principles and Criteria for Certification Authorities – Extended Validation Audit Criteria 1.4 b65

  http://www.webtrust.org/homepage-documents/item27839.aspx
• ASN.1 JavaScript decoder b67

  http://lapo.it/asn1js/
• Web PKI OPS b66

  https://datatracker.ietf.org/wg/wpkops/charter/
• Bug 725451: Support enforcing nested EKU constraints, do so by default b69

  https://bugzilla.mozilla.org/show_bug.cgi?id=725351
• RFC 3279: Algorithms and Identifiers for the Internet X.509 PKI and CRL Profile b68

  http://tools.ietf.org/html/rfc3279
• Root Certificate Policy b72

  http://www.chromium.org/Home/chromium-security/root-ca-policy
• Apple Root Certificate Program b71

  https://www.apple.com/certificateauthority/ca_program.html
• Mozilla CA Certificate Policy b74

  https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/
• X.509v3 Extension: OCSP Stapling Required b76

  http://tools.ietf.org/html/draft-hallambaker-muststaple-00
• Clarifying The Trustwave CA Policy Update b75

  https://www.trustwave.com/Resources/SpiderLabs-Blog/Clarifying-The-Trustwave-CA-Policy-Update/
• On the Cost of Factoring RSA-1024 b78

  http://www.tau.ac.il/~tromer/papers/cbtwirl.pdf
• HTTPS Everywhere b77

  https://www.eff.org/https-everywhere
• Facebook's outmoded Web crypto opens door to NSA spying b79

  http://www.cnet.com/uk/news/facebooks-outmoded-web-crypto-opens-door-to-nsa-spying/
• Dates for Phasing out MD5-based signatures and 1024-bit moduli b81

  https://wiki.mozilla.org/CA:MD5and1024
• Google certificates upgrade in progress b80

  http://googledevelopers.blogspot.co.uk/2013/07/google-certificates-upgrade-in-progress.html
• Bug #881553: Remove or turn off trust bits for 1024-bit root certs after December 31, 2013 b82

  https://bugzilla.mozilla.org/show_bug.cgi?id=881553
• HTTPS Everywhere & the Decentralized SSL Observatory b85

  https://www.eff.org/deeplinks/2012/02/https-everywhere-decentralized-ssl-observatory
• The EFF SSL Observatory b84

  https://www.eff.org/observatory
• The ICSI Certificate Notary b87

  https://notary.icsi.berkeley.edu/
• The SSL Landscape - A Thorough Analysis of the X.509 PKI Using Active and Passive Measurements b86

  https://pki.net.in.tum.de/node/15
• Analysis of the HTTPS Certificate Ecosystem b89

  https://zakird.com/slides/durumeric-https-imc13.pdf
• The ICSI SSL Notary: CA Certificates b88

  https://notary.icsi.berkeley.edu/trust-tree/
• University of Michigan · HTTPS Ecosystem Scans b90

  https://scans.io
• A novel method in IE11 for dealing with fraudulent digital certificates b92

  http://blogs.technet.com/b/pki/archive/2014/02/22/a-novel-method-in-ie11-for-dealing-with-fraudulent-digital-certificates.aspx
• Rapid7 · SSL Certificates b91

  https://scans.io/study/sonar.ssl
• Perspectives Project b94

  http://perspectives-project.org
• Web PKI: Closing the Gap between Guidelines and Practices b93

  http://research.microsoft.com/pubs/206278/ndss.pdf
• The Sovereign Keys Project b96

  https://www.eff.org/sovereign-keys
• Convergence b95

  http://web.archive.org/web/20150527165611/http://convergence.io/
• Certificate Transparency b98

  http://www.certificate-transparency.org/
• Mutually Endorsing CA Infrastructure version 2 b97

  http://kuix.de/mecai/
• Extended Validation in Chrome b99

  http://www.certificate-transparency.org/ev-ct-plan

4. Attacks against PKI

• Our Technology Statement from Gogo regarding our streaming video policy b609

  https://web.archive.org/web/20150404014855/http://concourse.gogoair.com/technology/statement-gogo-regarding-streaming-video-policy
• Revocation of an IGC/A branch b608

  https://web.archive.org/web/20141202143116/http://www.ssi.gouv.fr/en/the-anssi/events/revocation-of-an-igc-a-branch-808.html
• video b605

  https://www.youtube.com/watch?v=XCjoJePnRBY
• Public Announcements b607

  https://web.archive.org/web/20130926134541/http://turktrust.com.tr/en/kamuoyu-aciklamasi-en.2.html
• September 2011 Security Incident Report b606

  https://web.archive.org/web/20140202142309/https://www.globalsign.com/company/press/121311-security-incident-report.html
• Add Symantec Test Certs to OneCRL b638

  https://bugzilla.mozilla.org/show_bug.cgi?id=1214321
• Improved Digital Certificate Security b637

  https://security.googleblog.com/2015/09/improved-digital-certificate-security.html
• CA:WoSign Issues b639

  https://wiki.mozilla.org/CA:WoSign_Issues
• Announcing Version 2.1 of Mozilla CA Certificate Policy b512

  https://blog.mozilla.org/security/2013/02/15/announcing-version-2-1-of-mozilla-ca-certificate-policy/
• The Security Impact of HTTPS Interception b636

  https://jhalderm.com/pub/papers/interception-ndss17.pdf
• Collisions for hash functions MD4, MD5, HAVAL-128, and RIPEMD b511

  https://eprint.iacr.org/2004/199.pdf
• Announcing the first SHA1 collision b650

  https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html
• Windows SSL Interception Gone Wild b539

  https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339
• Komodia/Superfish SSL Validation is broken b538

  https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/
• Gogo no longer issuing fake Google SSL certificates b535

  https://www.runwaygirlnetwork.com/2015/01/13/gogo-no-longer-issuing-fake-google-ssl-certificates/
• Our Technology Statement from Gogo regarding our streaming video policy b534

  https://web.archive.org/web/20150404014855/http://concourse.gogoair.com/technology/statement-gogo-regarding-streaming-video-policy
• New collision attacks on SHA-1 based on optimal joint local-collision analysis b655

  https://marc-stevens.nl/research/papers/EC13-S.pdf
• Extracting the SuperFish certificate b537

  http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html
• #Superfish Round-Up b536

  https://noncombatant.org/2015/02/21/superfish-round-up/
• Tweet about SHA1 collision reuse b652

  https://twitter.com/realhashbreaker/status/835920234594861056
• A Finnish man created this simple email account - and received Microsoft's security certificate b531

  http://www.tivi.fi/Kaikki_uutiset/2015-03-18/A-Finnish-man-created-this-simple-email-account---and-received-Microsofts-security-certificate-3217662.html
• SHATTERED  b651

  https://shattered.io/
• sha1collisiondetection b654

  https://github.com/cr-marcstevens/sha1collisiondetection
• hey @Gogo, why are you issuing *.google.com certificates on your planes? b533

  https://twitter.com/__apf__/status/551083956326920192
• Maintaining digital certificate security b532

  https://googleonlinesecurity.blogspot.co.uk/2014/07/maintaining-digital-certificate-security.html
• SHA1 collisions make Git vulnerable to attacks by third-parties, not just repo maintainers b653

  http://www.metzdowd.com/pipermail/cryptography/2017-February/031623.html
• Ballot 169 – Revised Validation Requirements b649

  https://cabforum.org/2016/08/05/ballot-169-revised-validation-requirements/
• Re: Incident Report – Certificates issued without proper domain validation b648

  https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg05403.html
• StartEncrypt considered harmful today b645

  https://www.computest.nl/blog/startencrypt-considered-harmful-today/
• Automatic Certificate Management Environment b644

  https://github.com/ietf-wg-acme/acme/
• Incident Report – Certificates issued without proper domain validation b647

  https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg05398.html
• Incident Report - certificate with 'sb' as a SAN:dnsName b646

  https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg04274.html
• Distrusting WoSign and StartCom Certificates b641

  https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html
• Distrusting New WoSign and StartCom Certificates b640

  https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/
• Incident Report - OCR b642

  https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg04654.html
• MSRT March: Superfish cleanup b540

  https://blogs.technet.microsoft.com/mmpc/2015/03/09/msrt-march-superfish-cleanup/
• Distrusting New CNNIC Certificates b546

  https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/
• Maintaining digital certificate security b545

  https://googleonlinesecurity.blogspot.co.uk/2015/03/maintaining-digital-certificate-security.html
• Consequences of mis-issuance under CNNIC b547

  https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/czwlDNbwHXM/Fj-LUvhVQYEJ
• Check for bad certs from Komodia / Superfish b542

  https://superfish.tlsfun.de/
• Superfish, Komodia, PrivDog vulnerability test b541

  https://filippo.io/Badfish/
• The Risks of SSL Inspection b544

  https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html
• Comodo ships Adware Privdog worse than Superfish b543

  https://blog.hboeck.de/archives/865-Software-Privdog-worse-than-Superfish.html
• (Un)trusted Certificates b111

  https://blog.startcom.org/?p=145
• video b110

  https://www.youtube.com/watch?v=XCjoJePnRBY
• Cryptanalysis of MD5 Compress b117

  http://cseweb.ucsd.edu/%7Ebsy/dobbertin.ps
• Collisions for the compression function of MD5 b116

  https://securewww.esat.kuleuven.be/cosic/publications/article-143.pdf
• Colliding X.509 Certificates for Different Identities b119

  http://www.win.tue.nl/hashclash/TargetCollidingCertificates/
• Colliding X.509 Certificates based on MD5-collisions b118

  http://www.win.tue.nl/~bdeweger/CollidingCertificates/
• Unbelievable! b113

  https://groups.google.com/forum/#!topic/mozilla.dev.tech.crypto/nAzIKSBEh78
• SSL Certificate for Mozilla.com Issued Without Validation b112

  https://www.sslshopper.com/article-ssl-certificate-for-mozilla.com-issued-without-validation.html
• MD5 considered harmful today b115

  http://www.win.tue.nl/hashclash/rogue-ca/
• Re: Unbelievable!  b114

  https://groups.google.com/forum/#!msg/mozilla.dev.tech.crypto/nAzIKSBEh78/I1nFwuUkOF8J
• slides b109

  https://defcon.org/images/defcon-17/dc-17-presentations/defcon-17-zusman-hacking_pki.pdf
• Mike's Thawte tweet b106

  https://twitter.com/schmoilito/statuses/1089348859
• DNS vuln + SSL cert = FAIL b105

  https://web.archive.org/web/20100809095612/http://intrepidusgroup.com/insight/2008/07/dns-vuln-ssl-cert-fail/
• Full Disclosure b108

  https://blog.startcom.org/?p=161
• Nobody is perfect b107

  http://schmoil.blogspot.co.uk/2009/01/nobody-is-perfect.html
• How to Recognize Erroneously Issued VeriSign Code-Signing Certificates b102

  https://support.microsoft.com/en-us/kb/293817
• Erroneous VeriSign-Issued Digital Certificates Pose Spoofing Hazard b101

  https://technet.microsoft.com/library/security/ms01-017
• How to Remove a Root Certificate from the Trusted Root Store b104

  https://support.microsoft.com/en-us/kb/293819
• Microsoft, VeriSign, and Certificate Revocation b103

  https://web.archive.org/web/20151225181749/http://amug.org/~glguerin/opinion/revocation.html
• Response to some comments b131

  http://pastebin.com/GkKUhu35
• Another status update message b130

  http://pastebin.com/85WV10EL
• Is This MITM Attack to Gmail's SSL ? b133

  https://productforums.google.com/forum/#!msg/gmail/3J3r2JqFNTw/oHHZLJeedHMJ
• Cyber War b132

  https://blog.startcom.org/?p=229
• name and handle b139

  https://twitter.com/ichsunx2
• ComodoHacker account on Pastebin b138

  http://pastebin.com/u/ComodoHacker
• Black Tulip Update b135

  https://www.rijksoverheid.nl/documenten/rapporten/2012/08/13/black-tulip-update
• DigiNotar public report version 1 b134

  https://www.rijksoverheid.nl/ministeries/ministerie-van-binnenlandse-zaken-en-koninkrijksrelaties/documenten/rapporten/2011/09/05/diginotar-public-report-version-1
• September 2011 Security Incident Report b137

  https://web.archive.org/web/20140202142309/https://www.globalsign.com/company/press/121311-security-incident-report.html
• Striking Back... b136

  http://pastebin.com/1AxH30em
• What is Flame? b120

  http://www.kaspersky.com/flame
• Verisign and responsible disclosure b122

  http://www.phreedom.org/blog/2009/verisign-and-responsible-disclosure/
• CWI cryptanalyst discovers new cryptographic attack variant in Flame spy malware b121

  http://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-cryptographic-attack-variant-in-flame-spy-malware
• A message from Comodo Hacker b128

  http://pastebin.com/74KXCaEZ
• RE: Web Browsers and Comodo Announce A Successful Certificate Authority Attack, Perhaps From Iran b127

  https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/zgKmHOTIxn8/5NNYcgPNqlgJ
• New hack on Comodo reseller exposes private data b129

  http://www.theregister.co.uk/2011/05/24/comodo_reseller_hacked/
• Comodo Report of Incident b124

  https://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html
• This morning's MD5 attack - resolved b123

  http://www.symantec.com/connect/blogs/mornings-md5-attack-resolved
• Detecting Certificate Authority compromises and web browser collusion b126

  https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion
• Bug 642395: Deal with bogus certs issued by Comodo partner b125

  https://bugzilla.mozilla.org/show_bug.cgi?id=642395
• Further improving digital certificate security b153

  https://googleonlinesecurity.blogspot.co.uk/2013/12/further-improving-digital-certificate.html
• Public Announcements b152

  https://web.archive.org/web/20130926134541/http://turktrust.com.tr/en/kamuoyu-aciklamasi-en.2.html
• Improperly Issued Digital Certificates Could Allow Spoofing b155

  https://technet.microsoft.com/library/security/2916652
• Revoking Trust in one ANSSI Certificate b154

  https://blog.mozilla.org/security/2013/12/09/revoking-trust-in-one-anssi-certificate/
• Enhancing digital certificate security b151

  https://googleonlinesecurity.blogspot.co.uk/2013/01/enhancing-digital-certificate-security.html
• Counter-cryptanalysis b150

  https://marc-stevens.nl/research/papers/C13-S.pdf
• Revoking Trust in one ANSSI Certificate b157

  https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/uCZi6Ua-uPA
• Revocation of an IGC/A branch b156

  https://web.archive.org/web/20141202143116/http://www.ssi.gouv.fr/en/the-anssi/events/revocation-of-an-igc-a-branch-808.html
• Revoking Trust in DigiCert Sdn. Bhd Intermediate Certificate Authority b142

  https://blog.mozilla.org/security/2011/11/03/revoking-trust-in-digicert-sdn-bhd-intermediate-certificate-authority/
• Entrust Bulletin on Certificates Issued with Weak 512-bit RSA Keys by Digicert Malaysia b141

  https://web.archive.org/web/20150629012844/http://www.entrust.net/advisories/malaysia.htm
• Identification of a New Targeted Cyber-Attack b144

  https://web.archive.org/web/20140331222159/http://www.certcc.ir/index.php?name=news&file=article&sid=1894
• DigiCert, Inc. Of No Relation to Recent "Digi" Insecure Certificates b143

  https://www.digicert.com/news/2011-11-1-breaches-and-similar-names.htm
• Bug #698753: Entrust SubCA: 512-bit key issuance and other CPS violations; malware in the wild b140

  https://bugzilla.mozilla.org/show_bug.cgi?id=698753
• Microsoft Sub-CA used in malware signing b149

  http://lists.randombit.net/pipermail/cryptography/2012-June/002992.html
• Analyzing the MD5 collision in Flame b146

  http://blog.trailofbits.com/2012/06/11/analyzing-the-md5-collision-in-flame/
• Flame / Skywiper / Flamer reports b145

  http://www.crysys.hu/targeted-attacks.html
• Snack Attack: Analyzing Flame’s Replication Pattern b148

  https://threatpost.com/snack-attack-analyzing-flames-replication-pattern-060712/76660/
• Web Proxy Autodiscovery Protocol b147

  https://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol

5. HTTP and Browser Issues

• Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness b612

  https://www.usenix.org/conference/usenixsecurity13/technical-sessions/presentation/akhawe
• On the Challenges in Usable Security Lab Studies: Lessons Learned from Replicating a Study on SSL Warnings b611

  https://cups.cs.cmu.edu/soups/2011/proceedings/a3_Sotirakopoulos.pdf
• Measuring SSL Indicators on Mobile Browsers: Extended Life, or End of the Road? b613

  http://www.cc.gatech.edu/~traynor/papers/amrutkar-isc12.pdf
• Here’s My Cert, So Trust Me, Maybe? Understanding TLS Errors on the Web b610

  https://www.icsi.berkeley.edu/pubs/networking/ICSI_heresmycert13.pdf
• Token Binding Working Group b630

  https://datatracker.ietf.org/wg/tokbind/documents/
• Improving Revocation: OCSP Must-Staple and Short-lived Certificates b631

  https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/
• Cookie Prefixes b629

  https://datatracker.ietf.org/doc/draft-ietf-httpbis-cookie-prefixes/
• Firefox and Chrome start warning about insecure login forms b659

  https://www.feistyduck.com/bulletproof-tls-newsletter/issue_24_firefox_and_chrome_start_warning_about_insecure_login_forms.html
• Marking HTTP As Non-Secure b656

  https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure
• Percentage of Web Pages Loaded by Firefox Using HTTPS b658

  https://letsencrypt.org/stats/
• Google Transparency Report: HTTPS b657

  https://www.google.com/transparencyreport/https/metrics/
• CA:Revocation Plan b551

  https://wiki.mozilla.org/CA:RevocationPlan
• Revoking Intermediate Certificates: Introducing OneCRL b550

  https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/
• Requiring OCSP Stapling as a directive in HSTS b553

  https://www.ietf.org/mail-archive/web/websec/current/msg02297.html
• X.509v3 TLS Feature Extension b552

  https://datatracker.ietf.org/doc/rfc7633/
• Bug 901698 - implement OCSP-must-staple (off by default) b554

  https://bugzilla.mozilla.org/show_bug.cgi?id=901698
• Deprecating Powerful Features on Insecure Origins b661

  https://sites.google.com/a/chromium.org/dev/Home/chromium-security/deprecating-powerful-features-on-insecure-origins
• Next steps toward more connection security b660

  https://blog.chromium.org/2017/04/next-steps-toward-more-connection.html
• RFC 6960: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP b549

  https://tools.ietf.org/html/rfc6960
• Block Mixed Content for HSTS domains b548

  https://groups.google.com/forum/#!msg/mozilla.dev.security/rR3SBOFvUqM/GtFai0Zt1TcJ
• ocsp-stapling.md b662

  https://gist.github.com/sleevi/5efe9ef98961ecfb4da8
• No CRL UI as of Firefox 24 b210

  https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/ilOoDiCU4JM/-iABltbxlWIJ
• RFC 2014: HMAC: Keyed-Hashing for Message Authentication b12

  http://tools.ietf.org/html/rfc2104
• CRLSets b219

  http://dev.chromium.org/Home/chromium-security/crlsets
• Defeating OCSP With The Character '3' b216

  http://www.thoughtcrime.org/papers/ocsp-attack.pdf
• Revocation doesn't work b215

  https://www.imperialviolet.org/2011/03/18/revocation.html
• Revocation checking and Chrome's CRL b218

  https://www.imperialviolet.org/2012/02/05/crlsets.html
• CRL and OCSP behavior of iOS / Security.Framework? b217

  http://stackoverflow.com/questions/5625642/crl-and-ocsp-behavior-of-ios-security-framework
• How certificate revocation (doesn’t) work in practice b212

  http://news.netcraft.com/archives/2013/05/13/how-certificate-revocation-doesnt-work-in-practice.html
• As of Firefox 28, Firefox will not fetch CRLs during EV certificate validation b211

  https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/85MV81ch2Zo
• RFC 5019: The Lightweight OCSP Profile for High-Volume Environments b214

  http://tools.ietf.org/html/rfc5019
• RFC 2560: X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP b213

  http://www.ietf.org/rfc/rfc2560.txt
• CRLs tracked by Netcraft b209

  http://uptime.netcraft.com/perf/reports/performance/CRL
• NIST Workshop: Improving Trust in the Online Marketplace b208

  http://csrc.nist.gov/groups/ST/ca-workshop-2013/presentations/Koski_ca-workshop2013.pdf
• You Are What You Include: Large-scale Evaluation of Remote JavaScript Inclusions b205

  https://lirias.kuleuven.be/bitstream/123456789/354587/1/fp028-nikiforakis.pdf
• A Dangerous Mix: Large-scale analysis of mixed-content websites b204

  http://www.securitee.org/files/mixedinc_isc2013.pdf
• Sub-Prime PKI: Attacking Extended Validation SSL b207

  http://www.blackhat.com/presentations/bh-usa-09/SOTIROV/BHUSA09-Sotirov-AttackExtSSL-PAPER.pdf
• Beware of Finer-Grained Origins b206

  http://seclab.stanford.edu/websec/origins/fgo.pdf
• SSL/TLS Capabilities of Your Browser b201

  https://www.ssllabs.com/ssltest/viewMyClient.html
• Internet Explorer 9 Security Part 4: Protecting Consumers from Malicious Mixed Content b200

  https://blogs.msdn.microsoft.com/ie/2011/06/23/internet-explorer-9-security-part-4-protecting-consumers-from-malicious-mixed-content/
• A study of what really breaks SSL b203

  http://blog.ivanristic.com/2011/05/a-study-of-what-really-breaks-ssl.html
• W3C: Mixed Content b202

  https://w3c.github.io/webappsec-mixed-content/
• Certificate revocation and the performance of OCSP b221

  http://news.netcraft.com/archives/2013/04/16/certificate-revocation-and-the-performance-of-ocsp.html
• OCSP Uptime b220

  http://uptime.netcraft.com/perf/reports/OCSP
• Three years after Diginotar closed, hackers still trying to use its digital certificates b223

  http://www.cso.com.au/article/540551/three_years_after_diginotar_closed_hackers_still_trying_use_its_digital_certificates/
• 2013 Internet Security Threat Report, Volume 18 b222

  http://www.symantec.com/security_response/publications/threatreport.jsp
• EV SSL Certificate Guidelines  b63

  https://cabforum.org/extended-validation/
• Firesheep announcement b159

  http://codebutler.com/firesheep/
• SideJacking with Hamster b158

  http://blog.erratasec.com/2007/08/sidejacking-with-hamster_05.html
• TLS Channel IDs b175

  http://tools.ietf.org/html/draft-balfanz-tls-channelid-01
• SSLsplit - transparent and scalable SSL/TLS interception b177

  https://www.roe.ch/SSLsplit
• sslstrip b176

  http://www.thoughtcrime.org/software/sslstrip/
• Multiple Browser Cookie Injection Vulnerabilities b171

  http://www.westpoint.ltd.uk/advisories/wp-04-0001.txt
• New Ways I’m Going to Hack Your Web App b170

  http://media.blackhat.com/bh-ad-11/Lundeen/bh-ad-11-Lundeen-New_Ways_Hack_WebApp-WP.pdf
• Understanding Cookie Security b173

  http://kuza55.blogspot.co.uk/2008/02/understanding-cookie-security.html
• Hacking Github with Webkit b172

  http://homakov.blogspot.co.uk/2013/03/hacking-github-with-webkit.html
• Facebook's outmoded Web crypto opens door to NSA spying b178

  http://www.cnet.com/news/facebooks-outmoded-web-crypto-opens-door-to-nsa-spying/
• Active Gmail "Sidejacking" - https is NOT ENOUGH b164

  http://seclists.org/bugtraq/2007/Aug/70
• CookieCadger b163

  https://www.cookiecadger.com/
• CookieMonster b166

  http://fscked.org/projects/cookiemonster
• HTTPS Cookie Stealing b165

  http://fscked.org/talks/ActiveHTTPSCookieStealing.pdf
• BlackSheep b160

  https://www.zscaler.com/tools/blacksheep
• Idiocy b162

  http://jonty.co.uk/idiocy
• FireShepard b161

  https://notendur.hi.is/gas15/FireShepherd/
• Cross-Site Cooking b168

  http://www.securityfocus.com/archive/107/423375/30/0/threaded
• RFC 6265: HTTP State Management Mechanism b167

  http://tools.ietf.org/html/rfc6265
• Cookie forcing b169

  http://scarybeastsecurity.blogspot.co.uk/2008/11/cookie-forcing.html
• Bug 62178: Implement mechanism to prevent sending insecure requests from a secure context b197

  https://bugzilla.mozilla.org/show_bug.cgi?id=62178
• PSA: Tightening Blink's mixed content behavior b196

  https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/Uxzvrqb6IeU/9FAie9Py4cIJ
• SSL, TLS and a Little ActiveX: How IE7 Strikes a Balance Between Security and Compatibility b199

  https://blogs.msdn.microsoft.com/ie/2006/10/18/ssl-tls-and-a-little-activex-how-ie7-strikes-a-balance-between-security-and-compatibility/
• Mixed Content Blocking Enabled in Firefox 23! b198

  https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/
• Use AdSense on your HTTPS sites b193

  http://adsense.blogspot.co.uk/2013/09/use-adsense-on-your-https-sites13.html
• Usage statistics and market share of Google Analytics for websites b192

  http://w3techs.com/technologies/details/ta-googleanalytics/all/all
• Ending mixed scripting vulnerabilities b195

  http://blog.chromium.org/2012/08/ending-mixed-scripting-vulnerabilities.html
• Trying to end mixed scripting vulnerabilities b194

  https://googleonlinesecurity.blogspot.co.uk/2011/06/trying-to-end-mixed-scripting.html
• Mobile Users Three Times More Vulnerable to Phishing Attacks b191

  https://securityintelligence.com/mobile-users-3-times-more-vulnerable-to-phishing-attacks/
• Measuring SSL Indicators on Mobile Browsers: Extended Life, or End of the Road? b190

  http://www.cc.gatech.edu/~traynor/papers/amrutkar-isc12.pdf
• Experimenting At Scale With Google Chrome’s SSL Warning b186

  http://www.robreeder.com/pubs/sslExperimentCHI2014.pdf
• Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness b185

  https://www.usenix.org/conference/usenixsecurity13/technical-sessions/presentation/akhawe
• An Evaluation of Extended Validation and Picture-in-Picture Phishing Attacks b188

  http://www.adambarth.com/papers/2007/jackson-simon-tan-barth.pdf
• Exploring User Reactions to New Browser Cues for Extended Validation Certificates b187

  https://www.ccsl.carleton.ca/paper-archive/sobey-esorics-08.pdf
• TODO: Break Internet b182

  http://blog.johnath.com/2007/10/11/todo-break-internet/
• Bug 431827: Exceptions for invalid SSL certificates are too easy to add b181

  https://bugzilla.mozilla.org/show_bug.cgi?id=431827
• On the Challenges in Usable Security Lab Studies: Lessons Learned from Replicating a Study on SSL Warnings b184

  https://cups.cs.cmu.edu/soups/2011/proceedings/a3_Sotirakopoulos.pdf
• Bug 460374: All certificates show not trusted - get error code (MITM in-the-wild) b183

  https://bugzilla.mozilla.org/show_bug.cgi?id=460374
• Here’s My Cert, So Trust Me, Maybe? Understanding TLS Errors on the Web b180

  https://www.icsi.berkeley.edu/pubs/networking/ICSI_heresmycert13.pdf
• Web Security Context: User Interface Guidelines b189

  http://www.w3.org/TR/wsc-ui/

6. Implementation Issues

• MitM DNS Rebinding SSL/TLS Wildcards and XSS b614

  https://web.archive.org/web/20150315042723/http://ha.ckers.org/blog/20100822/mitm-dns-rebinding-ssltls-wildcards-and-xss/
• Add openssl_altchainsforgery_mitm_proxy.rb b604

  https://github.com/rapid7/metasploit-framework/pull/5735
• Add test for CVE-2015-1793 b603

  https://github.com/openssl/openssl/commit/593e9c638c58e1a510c519db0d024527113330f3
• Alternative chains certificate forgery b602

  https://openssl.org/news/secadv/20150709.txt
• Ticketbleed b633

  https://filippo.io/Ticketbleed/
• Virtual Host Confusion: Weaknesses and Exploits b515

  https://www.blackhat.com/docs/us-14/materials/us-14-Delignat-The-BEAST-Wins-Again-Why-TLS-Keeps-Failing-To-Protect-HTTP-wp.pdf
• Triple Handshakes and Cookie Cutters b621

  https://mitls.org/pages/attacks/3SHAKE
• Stop the presses: HTTPS-crippling “FREAK” bug affects Windows after all b557

  http://arstechnica.com/security/2015/03/stop-the-presses-https-crippling-freak-bug-affects-windows-after-all/
• HTTPS-crippling FREAK exploit affects thousands of Android and iOS apps b556

  http://arstechnica.com/security/2015/03/https-crippling-freak-exploit-hits-thousands-of-android-and-ios-apps/
• Security Advisory 3046015: Vulnerability in Schannel Could Allow Security Feature Bypass b559

  https://technet.microsoft.com/en-us/library/security/3046015.aspx
• About Security Update 2015-002 b558

  https://support.apple.com/en-us/HT204413
• Attack of the week: FREAK (or 'factoring the NSA for fun and profit') b555

  http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html
• Applying GREASE to TLS Extensibility b663

  https://datatracker.ietf.org/doc/draft-ietf-tls-grease/
• Internet Explorer should send TLS_FALLBACK_SCSV b571

  https://connect.microsoft.com/IE/feedback/details/1002874/internet-explorer-should-send-tls-fallback-scsv
• The POODLE Attack and the End of SSL 3.0 b570

  https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/
• About the security content of iOS 8.2 b560

  https://support.apple.com/en-us/HT204423
• Tracking the FREAK Attack b562

  https://freakattack.com/
• SSL Labs Client Test b561

  https://www.ssllabs.com/ssltest/
• TLS Fallback SCSV for Preventing Protocol Downgrade Attacks b568

  https://tools.ietf.org/html/draft-bmoeller-tls-downgrade-scsv-02
• Prying Eyes: Inside the NSA's War on Internet Security b567

  http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html
• RFC 7507: TLS Fallback SCSV for Preventing Protocol Downgrade Attacks b569

  https://datatracker.ietf.org/doc/rfc7507/
• miTLS b564

  https://www.mitls.org
• GitHub Gist: Temporary RSA 512 Bit Keylife for FREAK attack b563

  https://gist.github.com/ValdikSS/f4ba45198fe69c349e9c
• The Logjam Attack b566

  https://weakdh.org
• A Messy State of the Union: Taming the Composite State Machines of TLS b565

  https://www.smacktls.com/smack.pdf
• Apple's SSL/TLS bug b230

  https://www.imperialviolet.org/2014/02/22/applebug.html
• Dissecting the GnuTLS Bug b232

  http://blog.bro.org/2014/03/dissecting-gnutls-bug.html
• Advisories b231

  http://gnutls.org/security.html
• PKI Layer Cake: New Collision Attacks Against the Global X.509 Infrastructure b238

  https://securewww.esat.kuleuven.be/cosic/publications/article-1432.pdf
• The most dangerous code in the world: validating SSL certificates in non-browser software b237

  https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html
• More Tricks For Defeating SSL In Practice b239

  http://www.blackhat.com/presentations/bh-usa-09/MARLINSPIKE/BHUSA09-Marlinspike-DefeatSSL-SLIDES.pdf
• Early ChangeCipherSpec Attack b234

  https://www.imperialviolet.org/2014/06/05/earlyccs.html
• OpenSSL Security Advisory CVE-2014-0224 b233

  https://www.openssl.org/news/secadv/20140605.txt
• Frankencert b236

  https://github.com/sumanj/frankencert
• Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations b235

  https://www.cs.utexas.edu/%7Eshmat/shmat_oak14.pdf
• Incorrect checks for malformed signatures b227

  https://www.openssl.org/news/secadv/20090107.txt
• Analysis of vulnerability GNUTLS-SA-2008-3 CVE-2008-4989 b226

  http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217
• About the security content of iOS 7.0.6 b229

  https://support.apple.com/en-gb/HT202934
• TWSL2011-007: iOS SSL Implementation Does Not Validate Certificate Chain b228

  http://seclists.org/fulldisclosure/2011/Jul/315
• Internet Explorer SSL Vulnerability b225

  http://www.thoughtcrime.org/ie-ssl-chain.txt
• Certificate Validation Flaw Could Enable Identity Spoofing b224

  https://technet.microsoft.com/library/security/ms02-050
• Heartbleed b252

  https://en.wikipedia.org/wiki/Heartbleed
• Check Your Key b251

  https://factorable.net/
• OpenSSL Project Roadmap b254

  https://web.archive.org/web/20150815130657/http://openssl.org/about/roadmap.html
• Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL b253

  http://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/
• littleblackbox b250

  https://code.google.com/archive/p/littleblackbox
• Searching for The Prime Suspect: How Heartbleed Leaked Private Keys b259

  https://blog.cloudflare.com/searching-for-the-prime-suspect-how-heartbleed-leaked-private-keys/
• Half a million widely trusted websites vulnerable to Heartbleed bug b256

  http://news.netcraft.com/archives/2014/04/08/half-a-million-widely-trusted-websites-vulnerable-to-heartbleed-bug.html
• LibreSSL b255

  http://www.libressl.org/
• The Results of the CloudFlare Challenge b258

  https://blog.cloudflare.com/the-results-of-the-cloudflare-challenge/
• 300k servers vulnerable to Heartbleed one month later b257

  http://blog.erratasec.com/2014/05/300k-servers-vulnerable-to-heartbleed.html
• unssl.c b241

  http://www.mavi1.org/web_security/cryptography/General/unssl.c
• Randomness and the Netscape Browser b240

  http://www.cs.berkeley.edu/~daw/papers/ddj-netscape.html
• Diff of /openssl/trunk/rand/md_rand.c r140:r141 b243

  http://anonscm.debian.org/viewvc/pkg-openssl/openssl/trunk/rand/md_rand.c?r1=141&r2=140&view=diff&pathrev=141
• DSA-1571-1: openssl -- predictable random number generator b242

  http://www.debian.org/security/2008/dsa-1571
• Widespread Weak Keys in Network Devices b249

  https://factorable.net/
• RNG Bug May Result in Weak Cryptographic Keys b248

  http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2013-003.txt.asc
• Vendors Are Bad For Security b245

  http://www.links.org/?p=327
• Working exploit for Debian generated SSH Keys b244

  http://seclists.org/fulldisclosure/2008/May/410
• CryptGenRandom b247

  https://en.wikipedia.org/wiki/CryptGenRandom
• Debian and OpenSSL: The Aftermath b246

  http://www.links.org/?p=328
• An SCSV to stop TLS fallback. b274

  http://www.ietf.org/mail-archive/web/tls/current/msg10676.html
• TLS Fallback SCSV for Preventing Protocol Downgrade Attacks b273

  https://datatracker.ietf.org/doc/draft-bmoeller-tls-downgrade-scsv/
• Call for acceptance of draft-moeller-tls-downgrade-scsv b275

  http://www.ietf.org/mail-archive/web/tls/current/msg11171.html
• Fwd: New Version Notification for draft-pettersen-tls-version-rollback-removal-00.txt b270

  http://www.ietf.org/mail-archive/web/tls/current/msg08889.html
• SCSVs and SSLv3 fallback b272

  http://www.ietf.org/mail-archive/web/tls/current/msg09450.html
• Managing and removing automatic version rollback in TLS Clients b271

  https://datatracker.ietf.org/doc/draft-pettersen-tls-version-rollback-removal/
• Truncating TLS Connections to Violate Beliefs in Web Applications b277

  https://media.blackhat.com/us-13/US-13-Smyth-Truncating-TLS-Connections-to-Violate-Beliefs-in-Web-Applications-WP.pdf
• Pacemaker b263

  https://github.com/Lekensteyn/pacemaker
• Keys left unchanged in many Heartbleed replacement certificates! b262

  http://news.netcraft.com/archives/2014/05/09/keys-left-unchanged-in-many-heartbleed-replacement-certificates.html
• RFC 3546: TLS Extensions b265

  http://www.ietf.org/rfc/rfc3546.txt
• RFC 6101: The SSL Protocol Version 3.0, Section E.2. b264

  http://tools.ietf.org/html/rfc6101#appendix-E.2
• Heartbleed hacks hit Mumsnet and Canada’s tax agency b261

  http://www.bbc.co.uk/news/technology-27028101
• Attackers Exploit the Heartbleed OpenSSL Vulnerability to Circumvent Multi-factor Authentication on VPNs b260

  https://www.mandiant.com/blog/attackers-exploit-heartbleed-openssl-vulnerability-circumvent-multifactor-authentication-vpns/
• Standards work update b267

  https://web.archive.org/web/20140301045454/http://my.opera.com/yngve/blog/2012/11/02/standards-work-update
• Bug #450280: PSM sometimes falls back from TLS to SSL3 when holding F5 (which causes SNI to be disabled) b266

  https://bugzilla.mozilla.org/show_bug.cgi?id=450280
• Cipher suite values to indicate TLS capability b269

  http://www.ietf.org/mail-archive/web/tls/current/msg08861.html
• One approach to rollback protection b268

  https://www.ietf.org/mail-archive/web/tls/current/msg08099.html
• sslsniff b179

  http://www.thoughtcrime.org/software/sslsniff/

7. Protocol Attacks

• The CRIME attack b616

  http://netifera.com/research/crime/CRIME_ekoparty2012.pdf
• The pitfalls of allowing file uploads on your website b615

  http://labs.detectify.com/post/86302927946/the-lesser-known-pitfalls-of-allowing-file-uploads
• A Practical Attack on Broadcast RC4 b617

  http://saluc.engr.uconn.edu/refs/stream_cipher/mantin01attackRC4.pdf
• RFC 7366: Encrypt-then-MAC for TLS and DTLS b519

  https://tools.ietf.org/html/rfc7366
• Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN b634

  https://sweet32.info/
• My take on the SSL MITM Attacks – part 3 – the FTPS attacks b513

  http://blogs.msmvps.com/alunj/2009/11/18/my-take-on-the-ssl-mitm-attacks-part-3-the-ftps-attacks/
• RFC 7507: TLS Fallback SCSV for Preventing Protocol Downgrade Attacks  b624

  https://tools.ietf.org/html/rfc7507
• Crack in Internet’s foundation of trust allows HTTPS session hijacking b319

  http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/
• It's not a crime to build a CRIME b318

  https://gist.github.com/koto/3696912
• The CRIME attack b315

  http://netifera.com/research/crime/CRIME_ekoparty2012.pdf
• Compression contexts and privacy considerations b314

  https://groups.google.com/forum/#!msg/spdy-dev/B_ulCnBjSug/rcU-SIFtTKoJ
• CRIME - How to beat the BEAST successor? b317

  http://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor
• New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions b316

  https://threatpost.com/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512/76973/
• Compression and Information Leakage of Plaintext b311

  http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091
• The DROWN Attack b673

  https://drownattack.com/
•  b310

  https://src.chromium.org/viewvc/chrome/trunk/src/net/third_party/nss/patches/cbcrandomiv.patch?pathrev=97269
• Uncovering Spoken Phrases in Encrypted Voice over IP Conversations b313

  http://www.cs.unc.edu/%7Efabian/papers/tissec2010.pdf
• Language identification of encrypted VoIP traffic: Alejandra y Roberto or Alice and Bob? b312

  https://www.cs.jhu.edu/%7Ecwright/voip-vbr.pdf
• Vulnerability of SSL to Chosen-Plaintext Attack b308

  http://eprint.iacr.org/2004/111
• Blockwise-Adaptive Attackers: Revisiting the (In)Security of Some Provably Secure Encryption Modes: CBC, GEM, IACBC b307

  http://link.springer.com/content/pdf/10.1007%2F3-540-45708-9_2.pdf
• A Challenging but Feasible Blockwise-Adaptive Chosen-Plaintext Attack on SSL b309

  https://eprint.iacr.org/2006/136.pdf
• Security Losses from Obsolete and Truncated Transcript Hashes b667

  https://www.mitls.org/pages/attacks/SLOTH
• An Attack Against SSH2 Protocol b304

  http://www.weidai.com/ssh2-attack.txt
• CTX: Eliminating BREACH with Context Hiding b666

  https://www.blackhat.com/eu-16/briefings.html#ctx-eliminating-breach-with-context-hiding
• Problems with Proposed IP Cryptography b303

  http://web.cs.ucdavis.edu/~rogaway/papers/draft-rogaway-ipsec-comments-00.txt
• Breaking and Provably Repairing the SSH Authenticated Encryption Scheme: A Case Study of the Encode-then-Encrypt-and-MAC Paradigm b306

  https://eprint.iacr.org/2002/078.pdf
• Re: an attack against SSH2 protocol b305

  http://www.mail-archive.com/openssl-dev@openssl.org/msg10664.html
• bug #2635 b300

  https://rt.openssl.org/Ticket/Display.html?id=2635&user=guest&pass=guest
• HEIST b665

  https://www.blackhat.com/docs/us-16/materials/us-16-VanGoethem-HEIST-HTTP-Encrypted-Information-Can-Be-Stolen-Through-TCP-Windows.pdf
• Oracle Java SE Critical Patch Update Advisory - October 2011 b302

  http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html
• Opera 11.60 for Windows changelog b301

  http://www.opera.com/docs/changelogs/windows/1160/
• Rupture: A compression side-channel attack framework b664

  https://ruptureit.com
• Security Flaws Induced by CBC Padding - Applications to SSL, IPSEC, WTLS... b331

  https://www.iacr.org/archive/eurocrypt2002/23320530/cbc02_e02d.pdf
• Attacking SSL when using RC4 b573

  http://www.imperva.com/docs/HII_Attacking_SSL_when_using_RC4.pdf
• Attacks Only Get Better: Password Recovery Attacks Against RC4 in TLS b572

  http://www.isg.rhul.ac.uk/tls/RC4mustdie.html
• Padding oracle attack simulation b330

  http://erlend.oftedal.no/blog/poet/
• Poodle Bites TLS b579

  http://blog.ivanristic.com/2014/12/poodle-bites-tls.html
• RSA Security Response to Weaknesses in Key Scheduling Algorithm of RC4 b337

  http://www.emc.com/emc-plus/rsa-labs/historical/rsa-security-response-weaknesses-algorithm-rc4.htm
• Weaknesses in the Key Scheduling Algorithm of RC4 b336

  http://merlot.usc.edu/cs531-s11/papers/Fluhrer01a.pdf
• This POODLE bites: exploiting the SSL 3.0 fallback b578

  https://googleonlinesecurity.blogspot.co.uk/2014/10/this-poodle-bites-exploiting-ssl-30.html
• The ICSI Certificate Notary b339

  https://notary.icsi.berkeley.edu/#connection-cipher-details
• What's the deal with RC4? b338

  http://blog.cryptographyengineering.com/2011/12/whats-deal-with-rc4.html
• Security of CBC Ciphersuites in SSL/TLS: Problems and Countermeasures b333

  https://www.openssl.org/%7Ebodo/tls-cbc.txt
• The Web is World-Wide, or who still needs RC4? b575

  https://blog.cloudflare.com/the-web-is-world-wide-or-who-still-needs-rc4/
• RC4 No More b574

  https://www.rc4nomore.com/
• Password Interception in a SSL/TLS Channel b332

  http://www.iacr.org/cryptodb/archive/2003/CRYPTO/1069/1069.pdf
• ChaCha20 and Poly1305 based Cipher Suites for TLS b335

  https://datatracker.ietf.org/doc/draft-agl-tls-chacha20poly1305/
• RFC 7465: Prohibiting RC4 Cipher Suites b577

  https://tools.ietf.org/html/rfc7465
• Plaintext-Recovery Attacks Against Datagram TLS b334

  http://www.isg.rhul.ac.uk/%7Ekp/dtls.pdf
• Bug 1088915 - Stop offering RC4 in the first handshakes b576

  https://bugzilla.mozilla.org/show_bug.cgi?id=1088915
• A Perfect CRIME? TIME Will Tell b320

  https://media.blackhat.com/eu-13/briefings/Beery/bh-eu-13-a-perfect-crime-beery-wp.pdf
• Automated Padding Oracle Attacks with PadBuster b329

  http://blog.gdssecurity.com/labs/2010/9/14/automated-padding-oracle-attacks-with-padbuster.html
• breach attack b326

  http://mail-archives.apache.org/mod_mbox/httpd-dev/201308.mbox/%3CCAMDeyhwCYYQMK+WTfvge7y20AqEB1=kqMHgqKYhr3kBWkZyYzA@mail.gmail.com%3E
• Length Hiding Padding for the Transport Layer Security Protocol b325

  https://datatracker.ietf.org/doc/draft-pironti-tls-length-hiding/
• Lucky Thirteen: Breaking the TLS and DTLS Record Protocols b328

  http://www.isg.rhul.ac.uk/tls/Lucky13.html
• BREACH mitigation b327

  https://community.qualys.com/message/20404
• BREACH web site b322

  http://breachattack.com/
• BREACH: Reviving the CRIME Attack b321

  http://breachattack.com/resources/BREACH%20-%20SSL,%20gone%20in%2030%20seconds.pdf
• Usage share of web browsers b324

  https://en.wikipedia.org/wiki/Usage_share_of_web_browsers
• BREACH repository b323

  https://github.com/nealharris/BREACH
• SUPPLEMENTAL ITL BULLETIN FOR SEPTEMBER 2013 b351

  http://csrc.nist.gov/publications/nistbul/itlbul2013_09_supplemental.pdf
• On the Possibility of a Back Door in the NIST SP800-90 Dual Ec Prng b350

  http://rump2007.cr.yp.to/15-shumow.pdf
• On the Practical Exploitability of Dual EC in TLS Implementations b353

  http://dualec.org/
• Exclusive: Secret contract tied NSA and security industry pioneer b352

  http://www.reuters.com/article/us-usa-security-rsa-idUSBRE9BJ1C220131220
• Encrypt-then-MAC for TLS and DTLS b37

  https://tools.ietf.org/html/rfc7366
• Extended Random b354

  https://projectbullrun.org/dual-ec/ext-rand.html
• A Practical Attack on Broadcast RC4 b340

  http://saluc.engr.uconn.edu/refs/stream_cipher/mantin01attackRC4.pdf
• RFC 7568: Deprecating Secure Sockets Layer Version 3.0 b582

  https://tools.ietf.org/html/rfc7568
• PCI SSC bulletin on impending revisions to PCI DSS, PA-DSS b581

  http://training.pcisecuritystandards.org/pci-ssc-bulletin-on-impending-revisions-to-pci-dss-pa-dss-assessor
• Statistical Analysis of the Alleged RC4 Keystream Generator b342

  http://www.mindspring.com/%7Edmcgrew/rc4-03.pdf
• There are more POODLEs in the forest b580

  https://vivaldi.net/en-US/userblogs/entry/there-are-more-poodles-in-the-forest
• Revealed: how US and UK spy agencies defeat internet privacy and security b348

  http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security
• Secret Documents Reveal N.S.A. Campaign Against Encryption b347

  http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
• Dual_EC_DRBG b349

  https://en.wikipedia.org/wiki/Dual_EC_DRBG
• Unknown key-share attacks on the station-to-station (STS) protocol b344

  https://books.google.co.uk/books?id=cyHE4f0ukbYC&pg=PA154
• Prohibiting RC4 Cipher Suites b343

  https://datatracker.ietf.org/doc/draft-popov-tls-prohibiting-rc4/
• TLS Resumption Indication Extension b346

  https://datatracker.ietf.org/doc/draft-bhargavan-tls-resumption-indication/
• TLS Session Hash and Extended Master Secret Extension b345

  https://datatracker.ietf.org/doc/rfc7627/
• Internet SSL Survey 2010 is here! b83

  http://blog.ivanristic.com/2010/07/internet-ssl-survey-2010-is-here.html
• Bug #702111: Servers intolerant to 1/n-1 record splitting. "The connection was reset" b296

  https://bugzilla.mozilla.org/show_bug.cgi?id=702111
• Apple enabled BEAST mitigations in OS X 10.9 Mavericks b295

  http://blog.ivanristic.com/2013/10/apple-enabled-beast-mitigations-in-mavericks.html
• Microsoft Knowledge Base Article 2643584 b298

  https://support.microsoft.com/en-us/kb/2643584
• Microsoft Security Bulletin MS12-006 b297

  https://technet.microsoft.com/library/security/ms12-006
• The pitfalls of allowing file uploads on your website b292

  http://labs.detectify.com/post/86302927946/the-lesser-known-pitfalls-of-allowing-file-uploads
• BEAST b291

  http://vnhacker.blogspot.co.uk/2011/09/beast.html
• BEAST followup b294

  https://www.imperialviolet.org/2012/01/15/beastfollowup.html
• Bug #665814, comment #59: Rizzo/Duong chosen plaintext attack (BEAST) on SSL/TLS 1.0 b293

  https://bugzilla.mozilla.org/show_bug.cgi?id=665814#c59
• Here come the ⊕ Ninjas b290

  http://www.hit.bme.hu/%7Ebuttyan/courses/EIT-SEC/abib/04-TLS/BEAST.pdf
• NSS 3.13 Release Notes b299

  https://groups.google.com/forum/#!msg/mozilla.dev.tech.crypto/KMn9LWX3vVU/-XKglCaGHLcJ
• Redirecting and modifying SMTP mail with TLS session renegotiation attacks b285

  http://www.postfix.org/wip.html
• Generalization of the TLS Renegotiation Flaw Using HTTP 300 Redirection to Effect Cryptographic Downgrade Attacks b284

  http://www.leviathansecurity.com/white-papers/tls-and-ssl-man-in-the-middle-vulnerability/
• RFC 5746: TLS Renegotiation Indication Extension b287

  https://tools.ietf.org/html/rfc5746
• My take on the SSL MITM Attacks – part 3 – the FTPS attacks b286

  http://blogs.msmvps.com/alunj/2009/11/18/my-take-on-the-ssl-mitm-attacks-part-3-the-ftps-attacks/
• Renegotiating TLS b281

  http://ww1.prweb.com/prfiles/2009/11/05/104435/RenegotiatingTLS.pdf
• MITM attack on delayed TLS-client auth through renegotiation b280

  http://www.ietf.org/mail-archive/web/tls/current/msg03928.html
• TLS renegotiation vulnerability: definitely not a full blown MITM, yet more than just a simple CSRF b283

  http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html
• TLS/SSLv3 renegotiation vulnerability explained b282

  http://www.g-sec.lu/tools.html
• Re: Call for acceptance of draft-moeller-tls-downgrade-scsv b289

  http://www.ietf.org/mail-archive/web/tls/current/msg11270.html
• Secure browsing like it's 1995 b288

  https://web.archive.org/web/20140302021900/http://my.opera.com/securitygroup/blog/2011/03/17/secure-browsing-like-its-1995

8. Deployment

• Gradually sunsetting SHA-1 b516

  https://googleonlinesecurity.blogspot.co.uk/2014/09/gradually-sunsetting-sha-1.html
• SHA-256 Compatibility b520

  https://support.globalsign.com/customer/portal/articles/1499561-sha-256-compatibility
• Date Change for Migrating from SSL and Early TLS b668

  https://blog.pcisecuritystandards.org/migrating-from-ssl-and-early-tls
• Photos of an NSA “upgrade” factory show Cisco router getting implant b21

  http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/
• RFC 3526: More MODP Diffie-Hellman groups for IKE b359

  http://tools.ietf.org/html/rfc3526
• RFC 6460: Suite B Profile for TLS b358

  http://tools.ietf.org/html/rfc6460
• AWS CloudHSM b355

  https://aws.amazon.com/cloudhsm/
• SHA-256 certificates are coming b357

  https://www.imperialviolet.org/2014/05/14/sha256.html
• SHA1 Deprecation Policy b356

  http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx?Redirected=true
• PCI Council Publishes Revision to PCI Data Security Standard b583

  https://www.pcisecuritystandards.org/pdfs/15_04_15%20PCI%20DSS%203%201%20Press%20Release.pdf
• When HTTPS Meets CDN: A Case of Authentication in Delegated Service b362

  http://cobweb.cs.uga.edu/%7Ekangli/src/ieeesp2014.pdf
• The Web is World-Wide, or who still needs RC4? b360

  https://blog.cloudflare.com/the-web-is-world-wide-or-who-still-needs-rc4/
• SSL Pulse b70

  https://www.trustworthyinternet.org/ssl-pulse/

9. Performance Optimization

• Slowloris HTTP DoS b619

  https://web.archive.org/web/20150315054838/http://ha.ckers.org/slowloris/
• What is Network Latency and Why Does It Matter? b618

  http://www.o3bnetworks.com/wp-content/uploads/2015/02/white-paper_latency-matters.pdf
• HTTP/2 b584

  https://en.wikipedia.org/wiki/HTTP_2
• TLS Client Puzzles Extension b585

  https://datatracker.ietf.org/doc/draft-nygren-tls-client-puzzles/
• TCP Fast Open b373

  https://en.wikipedia.org/wiki/TCP_Fast_Open
• HTTP 2.0 b372

  https://en.wikipedia.org/wiki/HTTP_2
• CDN & PaaS performance b375

  https://istlsfastyet.com/#cdn-paas
• QUIC b374

  https://en.wikipedia.org/wiki/QUIC
• SPDY b371

  http://www.chromium.org/spdy/
• SSL_CTX_set_mode(3) b370

  https://www.openssl.org/docs/manmaster/ssl/SSL_CTX_set_mode.html
• SSL/TLS & Perfect Forward Secrecy b377

  http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html
• ivanr / ssl-dos b376

  https://github.com/ivanr/ssl-dos
• Elliptic Curve Cryptography (ECC) Certificates Performance Analysis b379

  http://www.symantec.com/content/en/us/enterprise/white_papers/b-wp_ecc.pdf
• An Experimental Study of TLS Forward Secrecy Deployments b378

  https://www.linshunghuang.com/papers/ecc-pfs.pdf
• Forward Secrecy at Twitter b361

  https://blog.twitter.com/2013/forward-secrecy-at-twitter-0
• Make Data Useful b364

  http://www.gduchamp.com/media/StanfordDataMining.2006-11-28.pdf
• Marissa Mayer at Web 2.0 b363

  http://glinden.blogspot.co.uk/2006/11/marissa-mayer-at-web-20.html
• Slowloris HTTP DoS b369

  https://web.archive.org/web/20150315054838/http://ha.ckers.org/slowloris/
• High Performance Browser Networking b366

  http://chimera.labs.oreilly.com/books/1230000000545
• Overclocking SSL b365

  https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html
• RFC 6928: Increasing TCP's Initial Window b368

  http://tools.ietf.org/html/rfc6928
• What is Network Latency and Why Does It Matter? b367

  http://www.o3bnetworks.com/wp-content/uploads/2015/02/white-paper_latency-matters.pdf
• Index of ftp://ftp.stunnel.org/sslsqueeze/ b394

  ftp://ftp.stunnel.org/sslsqueeze/
• TLS Symmetric Crypto b276

  https://www.imperialviolet.org/2014/02/27/tlssymmetriccrypto.html
• SSL computational DoS mitigation b391

  http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html
• Using Client Puzzles to Protect TLS Servers From Denial of Service Attacks b390

  https://datatracker.ietf.org/doc/draft-nir-tls-puzzles/
• SSL/TLS and Computational DoS b393

  http://www.educatedguesswork.org/2011/10/ssltls_and_computational_dos.html
• THC SSL DOS b392

  https://thehackerschoice.wordpress.com/2011/10/24/thc-ssl-dos/
• sslTransport.c b384

  http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslTransport.c
• Re-enable TLS False Start b383

  https://bugzilla.mozilla.org/show_bug.cgi?id=942729
• ChaCha20 and Poly1305 based Cipher Suites for TLS b386

  http://tools.ietf.org/html/draft-agl-tls-chacha20poly1305-04
• Networking Improvements in IE10 and Windows 8 b385

  http://blogs.msdn.com/b/ieinternals/archive/2012/08/01/internet-explorer-10-network-performance-improvements-first-available-pre-resolve-pre-connect-caching.aspx
• Transport Layer Security (TLS) False Start b380

  https://tools.ietf.org/html/draft-bmoeller-tls-falsestart-00
• False Start's Failure b382

  https://www.imperialviolet.org/2012/04/11/falsestart.html
• SSL FalseStart Performance Results b381

  http://blog.chromium.org/2011/05/ssl-falsestart-performance-results.html
• High Scalability for SSL and Apache b388

  http://www.awe.com/mark/talks/apachecon2000.pdf
• OPTIM: ssl: implement dynamic record size adjustment b387

  http://www.haproxy.org/git?p=haproxy.git;a=commit;h=7bed945be0cc9c91cd0114a9bcb965702f9389e3
• HTTP2 Expression of Interest b389

  http://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/0251.html

10. HSTS, CSP, and Pinning

• Public key pinning released in Firefox b517

  https://blog.mozilla.org/security/2014/09/02/public-key-pinning/
• Chrome HSTS preload request form b514

  https://hstspreload.appspot.com/
• Certificate pinning in Android 4.2 b418

  http://nelenkov.blogspot.co.uk/2012/12/certificate-pinning-in-android-42.html
• Your app shouldn't suffer SSL’s problems b417

  http://www.thoughtcrime.org/blog/authenticity-is-broken-in-ssl-but-your-app-ha/
• Public key pinning b419

  https://www.imperialviolet.org/2011/05/04/pinning.html
• Content Security Policy 1.0 lands in Firefox Aurora b414

  https://hacks.mozilla.org/2013/05/content-security-policy-1-0-lands-in-firefox-aurora/
• New Chromium security features, June 2011 b413

  http://blog.chromium.org/2011/06/new-chromium-security-features-june.html
• Safari 6 gets Content-Security-Policy right b416

  http://rachelbythebay.com/w/2012/07/29/csp/
• Shutting Down XSS with Content Security Policy b415

  https://blog.mozilla.org/security/2009/06/19/shutting-down-xss-with-content-security-policy/
• Content Security Policy b410

  https://dev.windows.com/en-us/microsoft-edge/platform/status/contentsecuritypolicy/
• Chrome 25 Beta: Content Security Policy and Shadow DOM b412

  http://blog.chromium.org/2013/01/content-security-policy-and-shadow-dom.html
• Content Security Policy b411

  http://caniuse.com/contentsecuritypolicy
• Server-Sent Events b407

  https://w3c.github.io/eventsource/
• Content Security Policy 1.1 b406

  http://www.w3.org/TR/CSP11/
• XMLHttpRequest Level 1 b409

  http://www.w3.org/TR/XMLHttpRequest/
• RFC 6455: The WebSocket Protocol b408

  https://tools.ietf.org/html/rfc6455
• Content Restrictions b403

  http://www.gerv.net/security/content-restrictions/
• The Double-Edged Sword of HSTS Persistence and Privacy b402

  http://www.leviathansecurity.com/blog/the-double-edged-sword-of-hsts-persistence-and-privacy/
• Content Security Policy 1.0 b405

  http://www.w3.org/TR/CSP/
• Content Security Policy b404

  http://people.mozilla.org/%7Ebsterne/content-security-policy/
• Preloading HSTS b401

  https://blog.mozilla.org/security/2012/11/01/preloading-hsts/
• HTTP Strict Transport Security b400

  http://www.chromium.org/sts
• Ballot 181 - Make CAA Checking Mandatory b670

  https://cabforum.org/2017/03/08/ballot-187-make-caa-checking-mandatory/
• DNSSEC authenticated HTTPS in Chrome b430

  https://www.imperialviolet.org/2011/06/16/dnssecchrome.html
• CAA Record Generator b671

  https://sslmate.com/labs/caa/
• RFC 6944: DNS Certification Authority Authorization (CAA) Resource Record b435

  http://tools.ietf.org/html/rfc6844
• Verisign Labs DANE Demonstration b432

  http://dane.verisignlabs.com/
• DNSSEC/TLSA Validator add-on for Web Browsers b431

  https://www.dnssec-validator.cz
• Trust Assertions for Certificate Keys b434

  https://tools.ietf.org/html/draft-perrin-tls-tack-02
• DANE TLS authentication b433

  http://www.postfix.org/TLS_README.html#client_tls_dane
• RFC 7218: Adding Acronyms to Simplify Conversations about DANE b429

  https://tools.ietf.org/html/rfc7218
• Fedora 21 To Have DNSSEC Validation Enabled By Default b428

  http://www.internetsociety.org/deploy360/blog/2014/05/fedora-21-to-have-dnssec-validation-enabled-by-default/
• RFC 6698: The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA b425

  https://tools.ietf.org/html/rfc6698
• Public Key Pinning Extension for HTTP b424

  https://datatracker.ietf.org/doc/rfc7469/
• Enterprise Certificate Pinning b669

  https://docs.microsoft.com/en-us/windows/access-protection/enterprise-certificate-pinning
• TLD DNSSEC Report b427

  http://stats.research.icann.org/dns/tld_report/
• Domain Name System Security Extensions b426

  https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions
• New Man-in-the-Middle attacks leveraging rogue DNS b421

  http://blog.phishlabs.com/new-man-in-the-middle-attacks-leveraging-rogue-dns
• transport_security_state_static.json b420

  https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json
• Announcing EMET 5.0 Technical Preview b423

  http://blogs.technet.com/b/srd/archive/2014/02/25/announcing-emet-5-0-technical-preview.aspx
• Enhanced Mitigation Experience Toolkit 4.1 b422

  http://www.microsoft.com/en-gb/download/details.aspx?id=41138
• RFC 6944: DNS Certification Authority Authorization (CAA) Resource Record b593

  https://datatracker.ietf.org/doc/rfc6844/
• RFC 7469: Public Key Pinning Extension for HTTP b592

  https://datatracker.ietf.org/doc/rfc7469/
• The Enhanced Mitigation Experience Toolkit b591

  https://support.microsoft.com/en-us/kb/2458544
• transport_security_state_static.json b590

  https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json
• Compatibility b589

  https://msdn.microsoft.com/en-us/library/dn904497%28v=vs.85%29.aspx#content_security_policy_1.0
• Bypassing HTTP Strict Transport Security b586

  https://www.blackhat.com/docs/eu-14/materials/eu-14-Selvi-Bypassing-HTTP-Strict-Transport-Security-wp.pdf
• Content Security Policy b588

  http://www.w3.org/TR/CSP/
• HTTP Strict Transport Security comes to Internet Explorer 11 on Windows 8.1 and Windows 7 b587

  https://blogs.windows.com/msedgedev/2015/06/09/http-strict-transport-security-comes-to-internet-explorer-11-on-windows-8-1-and-windows-7/
• ForceHTTPS: Protecting High-Security Web Sites from Network Attacks b395

  https://crypto.stanford.edu/forcehttps/forcehttps.pdf
• Stable Channel Update b397

  http://googlechromereleases.blogspot.co.uk/2010/01/stable-channel-update_25.html
• HTTP Strict Transport Security b396

  https://dev.windows.com/en-us/microsoft-edge/platform/status/httpstricttransportsecurityhsts/
• Web specifications support in Opera Presto 2.10 b399

  http://www.opera.com/docs/specs/presto2.10/#m210-244
• Firefox 4 release notes b398

  http://website-archive.mozilla.org/www.mozilla.org/firefox_releasenotes/en-US/firefox/4.0/releasenotes/
• RFC 6797: HTTP Strict Transport Security (HSTS) b174

  http://tools.ietf.org/html/rfc6797

11. OpenSSL

• OpenSSL CA configuration templates b632

  https://github.com/ivanr/bulletproof-tls/tree/master/private-ca
• RFC 7905: ChaCha20-Poly1305 Cipher Suites for TLS b672

  https://tools.ietf.org/html/rfc7905
• “openssl” source package in Precise b439

  https://launchpad.net/ubuntu/precise/+source/openssl
• Chrome: From NSS to OpenSSL b436

  https://docs.google.com/document/d/1ML11ZyyMpnAr6clIAwWrXD53pQgNR-DppMYwt9XvE6s/edit?pli=1
• Apache 2.4 VC11 Binaries and Modules Win32 and Win64 b438

  http://www.apachelounge.com/download/
• Win32 OpenSSL b437

  http://slproweb.com/products/Win32OpenSSL.html
• RFC 2985: PKCS #9: Selected Object Classes and Attribute Types Version 2.0 b441

  http://tools.ietf.org/html/rfc2985
• compiler hardening in Ubuntu and Debian b440

  https://outflux.net/blog/archives/2014/02/03/compiler-hardening-in-ubuntu-and-debian/
• Attacking Triple Encryption b443

  http://th.informatik.uni-mannheim.de/people/lucks/publ.shtml
• Cryptography/Meet In The Middle Attack b442

  https://en.wikibooks.org/wiki/Cryptography/Meet_In_The_Middle_Attack
• BoringSSL b594

  https://www.chromium.org/Home/chromium-security/boringssl
• On the Security of RC4 in TLS and WPA b341

  http://www.isg.rhul.ac.uk/tls/
• Baseline Requirements b64

  https://cabforum.org/baseline-requirements/

12. Testing with OpenSSL

• Bugs in Heartbleed detection scripts b444

  https://www.hut3.net/blog/cns---networks-security/2014/04/14/bugs-in-heartbleed-detection-scripts-
• Apple OpenSSL Verification Surprises b595

  https://hynek.me/articles/apple-openssl-verification-surprises/

13. Configuring Apache

• Bug #53219: mod_ssl should allow to disable ssl compression b620

  https://bz.apache.org/bugzilla/show_bug.cgi?id=53219
• USN-1898-1: OpenSSL vulnerability b450

  http://www.ubuntu.com/usn/usn-1898-1/
• RHSA-2013:0587-1 b452

  https://rhn.redhat.com/errata/RHSA-2013-0587.html
• Bug #857051: SSL/TLS CRIME attack against HTTPS, comment #5 b451

  https://bugzilla.redhat.com/show_bug.cgi?id=857051#c5
• TLS Interposer b447

  https://netfuture.ch/tools/tls-interposer/
• DSA-2579-1 apache 2 -- Multiple issues b449

  https://www.debian.org/security/2012/dsa-2579
• Increasing DHE strength on Apache 2.4.x b448

  http://blog.ivanristic.com/2013/08/increasing-dhe-strength-on-apache.html

14. Configuring Java and Tomcat

• JEP 246: Leverage CPU Instructions for GHASH and RSA b622

  http://openjdk.java.net/jeps/246
• Patch-in-Place and Static JRE Installation b458

  http://docs.oracle.com/javase/7/docs/webnotes/install/windows/patch-in-place-and-static-jre-installation.html
• Java 8 b457

  http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html
• Improved AES Crypto performance on Java with NSS using Intel® AES-NI Instructions b459

  https://software.intel.com/en-us/articles/improved-advanced-encryption-standard-aes-crypto-performance-on-java-with-nss-using-intel
• Java SE 7 Security b454

  http://docs.oracle.com/javase/7/docs/technotes/guides/security/
• Including Certificate Authority Root Certificates in Java b453

  http://www.oracle.com/technetwork/java/javase/javasecarootcertsprogram-1876540.html
• Java 7 b456

  http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html
• Java SE 8 Security Documentation b455

  http://docs.oracle.com/javase/8/docs/technotes/guides/security/
• SSL Support b472

  https://tomcat.apache.org/tomcat-8.5-doc/config/http.html#SSL_Support
• Bug #55988: Add parameter useCipherSuitesOrder to JSSE (BIO and NIO) connectors b471

  https://bz.apache.org/bugzilla/show_bug.cgi?id=55988
• Tomcat and SSL Accelerators b474

  http://blog.inuus.com/vox/2009/04/tomcat-and-ssl-accelerators.html
• SSL Valve b473

  http://tomcat.apache.org/tomcat-8.5-doc/config/valve.html#SSL_Valve
• Tomcat Native b470

  https://tomcat.apache.org/native-doc/
• JDK 8: The SunJSSE Provider b475

  http://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html#SunJSSEProvider
• JDK 8u51 Update Release Notes b596

  http://www.oracle.com/technetwork/java/javase/8u51-relnotes-2587590.html
• Easter Hack: Even More Critical Bugs in SSL/TLS Implementations b461

  http://armoredbarista.blogspot.co.uk/2014/04/easter-hack-even-more-critical-bugs-in.html
• JEP 164: Leverage CPU Instructions for AES Cryptography b460

  http://openjdk.java.net/jeps/164
• Customizable Items in JSSE b463

  http://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html#InstallationAndCustomization
• Transport Layer Security (TLS) Renegotiation Issue Readme b462

  http://www.oracle.com/technetwork/java/javase/documentation/tlsreadme2-176330.html
• mod_proxy_ajp b469

  https://httpd.apache.org/docs/trunk/mod/mod_proxy_ajp.html
• KeyStore Explorer b468

  http://keystore-explorer.org/
• The Essentials of Filters b465

  http://www.oracle.com/technetwork/java/filters-137243.html
• Provider Installation b464

  http://www.bouncycastle.org/wiki/display/JA1/Provider+Installation
• HeadLines b467

  https://github.com/sourceclear/headlines
• JSR-000315 Java™ Servlet 3.0 b466

  http://download.oracle.com/otndocs/jcp/servlet-3.0-fr-eval-oth-JSpec/

15. Configuring Microsoft Windows and IIS

• Switch to ECDSA hybrid certificates b600

  https://phabricator.wikimedia.org/T86654#1405484
• IIS 8.0 Centralized SSL Certificate Support: SSL Scalability and Manageability b500

  http://www.iis.net/learn/get-started/whats-new-in-iis-8/iis-80-centralized-ssl-certificate-support-ssl-scalability-and-manageability
• Vulnerabilities in SChannel could allow remote code execution b479

  https://support.microsoft.com/en-us/kb/980436
• Secure Channel b476

  https://msdn.microsoft.com/en-us/library/windows/desktop/aa380123(v=vs.85).aspx
• Secure Channel b597

  https://msdn.microsoft.com/en-us/library/windows/desktop/aa380123%28v=vs.85%29.aspx
• Update to Default Cipher Suite Priority Order b599

  https://technet.microsoft.com/en-us/library/security/3042058.aspx
• Vulnerability in TLS/SSL could allow spoofing b478

  https://support.microsoft.com/en-us/kb/977377
• Vulnerability in Schannel could allow information disclosure b598

  https://support.microsoft.com/en-us/kb/3061518
• BCryptGenerateKeyPair function b477

  https://msdn.microsoft.com/en-us/library/windows/desktop/aa375451%28v=vs.85%29.aspx
• httpCookies Element b494

  https://msdn.microsoft.com/library/ms228262(v=vs.100).aspx
• Transport Layer Security Cmdlets in Windows PowerShell b493

  https://technet.microsoft.com/en-us/library/dn296632.aspx
• Forward Secrecy at Twitter b496

  https://blog.twitter.com/2013/forward-secrecy-at-twitter-0
• HTTP Strict Transport Security IIS Module b495

  http://hstsiis.codeplex.com/
• Cipher Suites in Schannel b490

  https://msdn.microsoft.com/en-gb/library/windows/desktop/aa374757%28v=vs.85%29.aspx
• How to configure Secure Sockets Layer server and Client cache elements b492

  https://support.microsoft.com/en-us/kb/247658
• KB 2929781: Update adds new TLS cipher suites and changes cipher suite priorities in Windows 8.1 and Windows Server 2012 R2 b491

  https://support.microsoft.com/en-us/kb/2929781
• OCSP Stapling in IIS b498

  http://unmitigatedrisk.com/?p=95
• Microsoft Achieves World Domination (in OCSP Stapling) b497

  http://news.netcraft.com/archives/2013/07/19/microsoft-achieves-world-domination-in-ocsp-stapling.html
• SSL Host Headers in IIS 7 b499

  https://www.sslshopper.com/article-ssl-host-headers-in-iis-7.html
• Update for Disabling RC4 b483

  https://technet.microsoft.com/library/security/2868725
• An update is available that improves management of weak certificate cryptographic algorithms in Windows b482

  https://support.microsoft.com/en-us/kb/2862966
• SHA1 Deprecation Policy b485

  http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx
• IE11 Automatically Makes Over 40% of the Web More Secure While Making Sure Sites Continue to Work b484

  https://blogs.msdn.microsoft.com/ie/2013/11/12/ie11-automatically-makes-over-40-of-the-web-more-secure-while-making-sure-sites-continue-to-work/
• Update for Deprecation of MD5 Hashing Algorithm for Microsoft Root Certificate Program b481

  https://technet.microsoft.com/library/security/2862973
• Update For Minimum Certificate Key Length b480

  https://technet.microsoft.com/library/security/2661254
• Announcing the automated updater of untrustworthy certificates and keys b487

  http://blogs.technet.com/b/pki/archive/2012/06/12/announcing-the-automated-updater-of-untrustworthy-certificates-and-keys.aspx
• How to get a Root Certificate update for Windows b486

  https://technet.microsoft.com/en-us/library/dn265983.aspx
• Certificate Support and Resulting Internet Communication in Windows Vista b489

  https://technet.microsoft.com/en-us/library/cc749331%28WS.10%29.aspx
• Introduction to The Microsoft Root Certificate Program b73

  https://wiki.technet.microsoft.com/wiki/introduction-to-the-microsoft-root-certificate-program/
• Manage Trusted Root Certificates b488

  https://technet.microsoft.com/en-us/library/cc754841.aspx

16. Configuring Nginx

• Switch to ECDSA hybrid certificates b601

  https://phabricator.wikimedia.org/T86654
• Optimizing NGINX TLS Time To First Byte (TTTFB) b510

  http://mailman.nginx.org/pipermail/nginx/2013-December/041502.html
• Optimizing NGINX TLS Time To First Byte (TTTFB) b509

  https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/
• NGINX SSL Session Ticket Key b506

  http://mailman.nginx.org/pipermail/nginx/2014-February/042474.html
• Re: Distributed SSL session cache b505

  http://mailman.nginx.org/pipermail/nginx-devel/2013-September/004216.html
• crime tls attack b508

  http://mailman.nginx.org/pipermail/nginx/2012-September/035600.html
• [PATCH] SSL: ssl_session_tickets directive b507

  http://mailman.nginx.org/pipermail/nginx-devel/2014-January/004760.html
• Open sourcing our NGINX HTTP/2 + SPDY code b623

  https://blog.cloudflare.com/open-sourcing-our-nginx-http-2-spdy-code/
• ocsp stapling may send expired response b502

  https://trac.nginx.org/nginx/ticket/425
• [PATCH] RSA+DSA+ECC bundles b501

  http://mailman.nginx.org/pipermail/nginx-devel/2013-October/004376.html
• SSL Session Caching (in nginx) b504

  http://www.hezmatt.org/%7Empalmer/blog/2011/06/28/ssl-session-caching-in-nginx.html
• OCSP stapling patches b503

  http://mailman.nginx.org/pipermail/nginx-devel/2012-September/002682.html
• Red Hat Enterprise Linux 6.5 Release Notes b446

  https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html-single/6.5_Release_Notes/
• Bug #319901: missing ec and ecparam commands in openssl package b445

  https://bugzilla.redhat.com/show_bug.cgi?id=319901