Origin-bound certificates: A fresh approach to strong client authentication for the web

Proceedings of the 21st USENIX Security Symposium

Volumn , Issue , 2012, Pages 317-331

  Dietz, Michael ^a   Czeskis, Alexei ^b   Balfanz, Dirk ^c   Wallach, Dan S ^a  

^a RICE UNIVERSITY   (United States)

^b UNIVERSITY OF WASHINGTON   (United States)

^c GOOGLE INC   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

HTTP;

AUTHENTICATED CHANNEL; AUTHENTICATION MECHANISMS; AUTHENTICATION TOKEN; CLIENT AUTHENTICATION; PUBLIC KEYS; STONE AGE; WEB SERVING;

AUTHENTICATION;

EID: 84940397122     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (27)

1. H. Adkins. An update on attempted man-in-the-middle attacks. http://googleonlinesecurity.blogspot.com/2011/08/updateon-attempted-man-in-middle.html, Aug 2011.
2. D. Balfanz. TLS Origin-Bound Certificates. http://tools.ietf.org/html/draft-balfanz-tls-obc-01, Nov 2011.
3. J. Barr. AWS Elastic Load Balancing: Support for SSL Termination. http://aws.typepad.com/aws/2010/10/elastic-loadbalancer-support-for-ssl-termination.html, Oct 2010.
4. S. Blake-Wilson, T. Dierks, and C. Hawk. ECC Cipher Suites for TLS. http://tools.ietf.org/html/draft-ietftls-ecc-01, March 2001.
5. S. Blake-Wilson, M. Nystrom, D. Hopwood, J. Mikkelsen, and T. Wright. Transport layer security (tls) extensions. http://tools.ietf.org/html/rfc4366, Apr 2006.
6. A. Bortz, A. Barth, and A. Czeskis. Origin cookies: Session integrity for web applications. In Web 2.0 Security & Privacy, 2011.
7. E. Butler. Firesheep. http://codebutler.com/firesheep, 2010.
8. A. Czeskis and D. Balfanz. Protected Login. In Proceedings of the Workshop on Usable Security (at the Financial Cryptography and Data Security Conference), March 2012.
9. T. Dierks and C. Allen. The TLS Protocol, Version 1.0. Internet Engineering Task Force, Jan. 1999. RFC-2246, ftp://ftp.isi.edu/in-notes/rfc2246.txt.
10. T. Dierks and E. Rescorla. The Trandsport Layer Security (TLS) Protocol Version 1.2 – Client Certificates, 2008. http://tools.ietf.org/html/rfc5246#section-7.4.6.
11. I. Hickson. HTML5 Web Messaging. http://dev.w3.org/html5/postmsg/, Jan 2012.
12. J. Hurwich. Chrome benchmarking extension. http://www.chromium.org/developers/designdocuments/extensions/how-the-extension-systemworks/chrome-benchmarking-extension, Sept 2010.
13. Microsoft. Introducing windows cardspace, 2006. http://msdn.microsoft.com/en-us/library/aa480189.aspx.
14. Mozilla. BrowserID, 2012. https://developer.mozilla.org/en/BrowserID.
15. S. Murdoch. Hardened stateless session cookies. Security Protocols XVI, pages 93–101, 2011.
16. A. Mushaq. Man in the Browser: Inside the Zeus Trojan, 2010. http://threatpost.com/en\_us/blogs/manbrowser-inside-zeus-trojan-021910.
17. R. Oppliger, R. Hauser, and D. Basin. SSL/TLS session-aware user authentication–or how to effectively thwart the man-in-the-middle. Computer Communications, 29(12):2338–2246, 2006.
18. R. Opplinger, R. Hauser, and D. Basin. SSL/TLS session-aware user authentication revisited. Computers & Security, 27(3-4):64–70, 2008.
19. S. Park and D. L. Dill. Verification of cache coherence protocols by aggregation of distributed transactions. Theory of Computing Systems, 31(4):355–376, 1998.
20. D. Recordon and B. Fitzpatrick. OpenID authentication 1.1. http://openid.net/specs/openid-authentication1_1.html, May 2008.
21. E. Rescorla. Keying Material Exporters for Transport Layer Security (TLS). http://tools.ietf.org/html/rfc5705, March 2010.
22. J. Rizzo and T. Duong. Beast. http://vnhacker.blogspot.com/2011/09/beast.html, Sept 2011.
23. N. Sakimura, D. Bradley, B. de Mederiso, M. Jones, and E. Jay. OpenID connect standard 1.0 - draft 07. http://openid.net/specs/openid-connect-standard-1
24. C. M. Shields and M. M. Toussain. Subterfuge: The MITM Framework. http://subterfuge.googlecode.com/files/Subterfuge-WhitePaper.pdf, 2012.
25. A. S. Tanenbaum, S. J. Mullender, and R. van Renesse. Using sparse capabilities in a distributed operating system. In 6th International Conference on Distributed Computing Systems, pages 558–563, Cambridge, Massachusetts, May 1986.
26. The Chromium Project. SPDY, 2012. http://www.chromium.org/spdy.
27. E. Wobber, M. Abadi, M. Burrows, and B. Lampson. Authentication in the Taos operating system. ACM Transactions on Computer Systems (TOCS), 12(1):3–32, 1994.