New TLS/SSL Version Ready In 2015

One of the first steps in making encryption the norm across the Net is an update to the protocol itself and a set of best-practices for using encryption in applications.

The Internets standards body next year will release the newest version of the Transport Layer Security (TLS) protocol, which, among other things, aims to reduce the chance of implementation errors that have plagued the encryption space over the past year.
The more streamlined Version 1.3 of TLS (TLS is the newest generation of its better known predecessor, SSL) trims out unnecessary features and functions that ultimately could lead to buggy code. The goal is a streamlined yet strong encryption protocol thats easier to implement and less likely to leave the door open to implementation flaws.
Having options in there that are a smoking gun and one developer gets wrong… could lead to a huge security problem, Russ Housley, chair of the Internet Architecture Board (IAB), says of the problem that TLS 1.3 aims to solve.
Thats the kind of scenario that
led to the Heartbleed bug
in the OpenSSL implementation of the encryption protocol. Heartbleed came out of an error in OpenSSLs deployment of the heartbeat extension in TLS. The bug, if exploited, could allow an attacker to leak the contents of the memory from the server to the client and vice versa. That could leave passwords and even the SSL servers private key potentially exposed in an attack.
[The era of encrypted communications may have finally arrived. Internet Architecture Board chairman Russ Housley explains what the IABs game-changing statement about encryption means for the future of the Net:
Q&A: Internet Encryption As The New Normal
.]
Aside from the updated TLS protocol, the Internet Engineering Task Force (IETF), which crafts the protocols, also is looking at how to better deploy encryption in applications. The IETFs Using TLS in Applications (UTA) working group will offer best-practices for using TLS in applications, as well as guidance on how certain applications should use the encryption protocol, which also will promote interoperability among encrypted systems.
Pete Resnick, the IETFs applications area director, says among the best-practices are the use of the latest crypto algorithms and avoiding the use of weak (or no) encryption, as well as eliminating the use of older TLS/SSL versions. This will end up making things more secure in the long run by providing common guidelines across implementations, he says.
UTA also is working on guidance for using TLS with the instant messaging protocol XMPP (a.k.a. Jabber) and also using TLS with email client protocols POP, IMAP, and SMTP Submission. The goal is to make encryption more interoperable among messaging servers to help propel the use of encrypted communications, according to Resnick.

Last News
▸ Sony, XBox Targeted by DDoS Attacks, Hacktivist Threats ◂ Discovered: 23/12/2024 Category: security	▸ There are plenty of online tools for reporting bugs. ◂ Discovered: 23/12/2024 Category: security	▸ 27 Million South Koreans Hit by Online Gaming Theft. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New TLS/SSL Version Ready In 2015