Cryptography in the age of Heartbleed
summary
Heartbleed opens the door to concrete failures: 30% of servers still accept export‑grade RSA, a 512‑bit RSA key can be cracked in about an hour for tens of dollars, and attacks like FREAK and Logjam show protocol downgrade and Diffie‑Hellman pitfalls. Audits find implementation and API errors that let apps skip hostname checks; Juniper devices hide a backdoorable RNG. Practical fixes exist — e.g. crypto_box / libsodium — and adoption determines whether they actually stop data loss.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:43My background
- 3:32Why this talk?
- 10:56SSL/TLS
- 13:41How secure is TLS? - Many active attacks and implementation vulnerabilities
- 14:28Why these problems?
- 14:57Quite a bit
- 16:34Ciphersuite Negotiation
- 17:49MITM Negotiation
- 21:30Example 2: Negotiation
- 25:28Crypto library APIs
- 26:27Present Day
- 27:09Too much complexity 2/3
- 28:54Algorithm Choices 1/2
- 32:03Ambiguous specification 1/2
- 33:17Non-intuitive interfaces 3/7
- 37:26Language problems
- 39:15Software
- 40:34CVE-2015-7756
- 43:36Crypto is hard
