Josef Cacek

• Security engineer / Java developer at Hazelcast
• Father
• Runner
• Open-source contributor

Demo

I. Choose the protocol and its parameters wisely!

• Protected application running at https://hazelcast-test.cacek.cz/
• attacker captures the communication
• they are able to decrypt it, if they get access to the server's private key

Motivation

II. Measure what it costs you using the TLS.

• know the TLS price
• what are your preferences?
  • throughput
  • latency
  • CPU load

Hazelcast performance testing

• tool: Hazelcast Simulator (github.com/hazelcast/hazelcast-simulator)
• test configuration:
  • 2 servers
  • 4 clients
  • TLS enabled in client-to-member communication

Plain vs TLS

Demo

III. Don't forget the checks, which you don't get for free in Java.

• What can happen if you don't enable hostname validation?
• Java Mail API tutorial - https://kodejava.org/how-do-i-receive-mail-using-pop3/
  • Receive mails using POP3+TLS
• Man in the middle intercepting
  • with a valid certificate for another hostname

Demo

III. Don't forget the checks, which you don't get for free in Java.

• What can happen if you don't enable hostname validation?
• Java Mail API tutorial - https://kodejava.org/how-do-i-receive-mail-using-pop3/
  • Receive mails using POP3+TLS
• Man in the middle intercepting
  • with a valid certificate for another hostname

MITM in Raspberry Pi 3

iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -i wlan0 -p tcp -m tcp --dport 995 -j REDIRECT --to-ports 8443
sslsplit -S logs -A hazelcast-test.pem ssl 0.0.0.0 8443 tcp 0.0.0.0 8080

Demo

Bonus: Know your tools

• Debug TLS connections

  java -Djavax.net.debug=ssl:handshake ...

• Dump TCP traffic E.g. HTTPS:

  sudo tcpdump -i any -s0 -w https-traffic.pcap 'port 443'

• Analyze the capture in WireShark
• OpenSSL tool - swiss knife for the TLS

Forward secrecy

• mandatory in TLS 1.3
• choose ciphersuites wisely in older versions
  • avoid RSA key exchange

Role of Ciphersuites in the TLS

Ciphersuite

• named set of cryptographic primitives
• client and server agrees on it
• defines how security will be implemented

TLS is a framework, Ciphersuite selects how security will be implemented.

Role of Ciphersuites in the TLS

Ciphersuite

• named set of cryptographic primitives
• client and server agrees on it
• defines how security will be implemented

TLS is a framework, Ciphersuite selects how security will be implemented.

Example

E.g. "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"

• authentication: ECDSA
• key exchange: ECDHE
• cipher (encryption algorithm, key-size, mode): AES-256-GCM
• pseudorandom function: SHA-384

JSSE classes and interfaces

SSLContext initialization

KeyStore keyStore = KeyStore.getInstance("PKCS12");
KeyStore trustStore = KeyStore.getInstance("PKCS12");
try (InputStream kis = new FileInputStream("keystore.p12");
            InputStream tis = new FileInputStream("truststore.p12")) {
    keyStore.load(kis, password);
    trustStore.load(tis, "s3crEt".toCharArray());
    KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    kmf.init(keyStore, password);
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    tmf.init(trustStore);
    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom());
    //... getServerSocketFactory, createSSLEngine, ...
}

Setting protocols and ciphersuites

SSLSocket sslSocket = (SSLSocket) sslContext.getSocketFactory()
        .createSocket("pop.gmail.com", 995);
sslSocket.setEnabledProtocols(new String[] {"TLSv1.2", "TLSv1.3"});
sslSocket.setEnabledCipherSuites(new String[] {
        "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", 
        "TLS_AES_256_GCM_SHA384"});

Recommendations for a cipher string

• Check OWASP TLS Cipher String Cheat Sheet
• https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/TLS_Cipher_String_Cheat_Sheet.md

Full Handshake in TLS 1.2

      Client                                               Server
      ClientHello                  -------->
                                                      ServerHello
                                                     Certificate*
                                               ServerKeyExchange*
                                              CertificateRequest*
                                   <--------      ServerHelloDone
      Certificate*
      ClientKeyExchange
      CertificateVerify*
      [ChangeCipherSpec]
      Finished                     -------->
                                               [ChangeCipherSpec]
                                   <--------             Finished
      Application Data             <------->     Application Data

Full Handshake in TLS 1.3

       Client                                           Server
Key  ^ ClientHello
Exch | + key_share*
     | + signature_algorithms*
     | + psk_key_exchange_modes*
     v + pre_shared_key*       -------->
                                                  ServerHello  ^ Key
                                                 + key_share*  | Exch
                                            + pre_shared_key*  v
                                        {EncryptedExtensions}  ^  Server
                                        {CertificateRequest*}  v  Params
                                               {Certificate*}  ^
                                         {CertificateVerify*}  | Auth
                                                   {Finished}  v
                               <--------  [Application Data*]
     ^ {Certificate*}
Auth | {CertificateVerify*}
     v {Finished}              -------->
       [Application Data]      <------->  [Application Data]

Hazelcast IMDG

HazelcastInstance hz = HazelcastClient.newHazelcastClient();
Map<Integer, User> userCache = hz.getMap("users");
User user = userCache.get(id);
if (user == null) {
    user = dbUtil.loadUser(id);
    userCache.put(id, user);
}

Goals:

• performance
• simplicity

Hazelcast TLS performance tests

• configuration
  • Hazelcast: 2 members + 4 clients
  • Java (Zulu/OpenJDK): 8 v 11 v 13
  • TLS engine: JSSE v BoringSSL
  • TLS protocol: TLSv1.2 v TLSv1.3
• TLS enabled for client-member connections
• scenario: Map operations executed by clients on cluster members

TLS handshake latencies test

Native TLS libraries - OpenSSL / BoringSSL

• available through netty-tcnative - https://netty.io/wiki/forked-tomcat-native.html
• Maven Dependencies:
  • io.netty:netty-handler
  • io.netty:netty-tcnative (dynamicallly linked OpenSSL)
  • io.netty:netty-tcnative-boringssl-static (statically linked BoringSSL)

Native TLS libraries - OpenSSL / BoringSSL

• available through netty-tcnative - https://netty.io/wiki/forked-tomcat-native.html
• Maven Dependencies:
  • io.netty:netty-handler
  • io.netty:netty-tcnative (dynamicallly linked OpenSSL)
  • io.netty:netty-tcnative-boringssl-static (statically linked BoringSSL)  

import io.netty.buffer.UnpooledByteBufAllocator;
import io.netty.handler.ssl.SslContext;
import io.netty.handler.ssl.SslContextBuilder;
import io.netty.handler.ssl.SslProvider;
import javax.net.ssl.SSLEngine;
SslContext context = SslContextBuilder.forClient()
    .trustManager(new File("ca.crt"))
    .sslProvider(SslProvider.OPENSSL)
    .build();
SSLEngine sslEngine = context.newEngine(UnpooledByteBufAllocator.DEFAULT);

Hostname validation and Server Name Indication

• X.509 certificates may contain Subject Alternative Names (SAN) extension
  • Several RFCs specify how to check hostnames and IP addresses against SAN entries
• hostname checking in Java
  • out-of-the-box: HTTPS and LDAPS client
  • custom options e in some API (e.g. Java Mail)
  • manually through SSLParameters (SSLSocket, SSLEngine)

SSLParameters params = sslEngine.getSSLParameters();
// Use Server Name Indication
params.setServerNames(Arrays.asList(new SNIHostName("www.google.com")));
// Enable hostname validation (available algorithms: LDAPS, HTTPS)
params.setEndpointIdentificationAlgorithm("HTTPS");
sslEngine.setSSLParameters(params);

Certificate status

• revocation checks can be enabled by Security and System properties
  • CRL DP
  • OCSP
  • OCSP stapling
• validity is not checked for self-signed certificates
  • manual check: ((X509Certificate) certificate).checkValidity()

Keystore types

• PKCS12
  • open standard format and algorithms
  • keystore default type from Java 9
• JKS and JCEKS
  • proprietary
  • implementations are not compatible accross vendors
• Security evaluation of Java Keystores:
  • https://minimalblue.com/data/papers/NDSS2018_mind_your_keys.pdf

Let's Encrypt, certbot & ACME

• Let's Encrypt - Free Certificate Authority (CA)
• ACME - Automatic Certificate Management Environment
• certbot - ACME protocol client

Java integration

DOMAIN=java2days.cacek.cz
# Obtain Certificate from Let's Encrypt CA
certbot certonly --standalone -d $DOMAIN
# Import private key and certificates to a keystore
openssl pkcs12 -export -out /opt/keystore-$DOMAIN.p12 \
  -in /etc/letsencrypt/live/$DOMAIN/fullchain.pem \
  -inkey /etc/letsencrypt/live/$DOMAIN/privkey.pem \
  -password pass:pass.123