This document presents TLS and how to make it secure enough as of 2014 Spring. Of course all the information given here will rot with time. Protocols known as secure will be cracked and will be replaced with better versions. Fortunately we will see that there are ways to assess the current security of your setup, but this explains why you may have to read further from this document to get the up to date knowledge on TLS security.
We will first introduce the TLS protocol and its underlying components: X.509 certificates, ciphers, and protocol versions. Next we will have a look at TLS hardening for web servers, and how to plug various vulnerabilities: CRIME, BREACH, BEAST, session renegotiation, Heartbleed, and others. We will finally see how the know-how acquired on hardening web servers can be used for other protocols and tools such as Dovecot, Sendmail, SquirrelMail, RoundCube, and OpenVPN.
We assume you already maintain services that use TLS, and have basic TCP/IP network knowledge. Some information will also be useful for the application developer.
Missed Opportunities: Measuring the Untapped TLS Support in the Industrial Internet of Things
将工业设备从以前孤立的网络转移到互联网的持续趋势需要对安全性进行根本性的改变，以维护安全和安全的操作。因此，为了确保端到端的安全通信和认证，（i）传统的工业协议，例如，Modbus，被改造为TLS支持，以及（ii）现代协议，例如，MQTT直接设计为使用TLS。为了了解这些变化是否确实导致安全的工业物联网部署，即，使用根据安全最佳实践配置的基于TLS的协议，我们对覆盖整个IPv4地址空间的10个工业协议进行了Internet范围的安全评估。我们的研究结果表明，改造现有的协议和新开发的安全替代品，在野外几乎不引人注目。虽然我们发现新协议的TLS采用率高于传统协议（7.2% vs. 0.4%），但TLS的总体采用率很低（6.5%的主机）。因此，大多数工业部署（934，736台主机）都不安全地连接到Internet。此外，我们发现42%支持TLS的主机（26，665台主机）显示出安全缺陷，例如，缺少访问控制。最后，我们表明，支持配置系统安全，例如，通过配置模板，有望加强安全性。
JSON Web Token (JWT) based client authentication in Message Queuing Telemetry Transport (MQTT)
本文概述了JSON Web令牌（JWT）和传输层安全性（TLS）作为互联网上事物认证的两种主要方法。JSON Web Token（JWT）目前被广泛用于OAuth和OpenId框架中的授权和身份验证。最近，Google Cloud IoT强制要求将JWT用于基于HTTP和消息传输远程传输（MQTT）协议的客户端，通过TLS安全地连接到云服务。MQTT是物联网设备中的首选协议，也是本文作为应用协议的主要关注点。另一个流行的云平台Amazon Web Service（AWS）使用TLS双向身份验证进行客户端身份验证。这里提供的两种方法之间的任何比较主要是从受约束的设备客户端的角度。
PQC standards alternatives -- reliable semantically secure key encapsulation mechanism and digital signature protocols using the rank-deficient matrix power function
Economic Science School, School of Exact and Natural Sciences and Engineering School, University of Buenos Aires（布宜诺斯艾利斯大学经济科学学院、精确与自然科学与工程学院）；Computer Science Department, School of Exact and Natural Sciences, University of Buenos Aires（布宜诺斯艾利斯大学精确与自然科学学院计算机科学系）
HPQ-AKE: A Provably Secure Sign-Less Hybrid Authenticated Key Exchange Protocol for Bandwidth-Constrained IoT and Edge Networks
Ho Chi Minh City Open University（胡志明市开放大学）；Faculty of Information Technology, Ho Chi Minh City University of Industry and Trade (HUIT)（胡志明市工业贸易大学信息技术学院）；Faculty of Information Technology, Ho Chi Minh City Open University（胡志明市开放大学信息技术学院）；Faculty of Computer Science and Engineering, Ho Chi Minh City University of Technology (HCMUT)（胡志明市理工大学计算机科学与工程系）；Vietnam National University Ho Chi Minh City（越南国家大学胡志明市分校）
