Ceremonies (in 3 minutes)

1
Ceremonies(in 3 minutes)

• Carl M. Ellison
• Microsoft
• 16 August 2005

2
Network Protocol
B
C
D
A
3
Ceremony
B
C
D
A
4
HTTPS MITM Protocol
Legitimate
MITM
User
PC
HTTP(S)
HTTP(S)
Channel Setup
a
b
c
d
5
HTTPS MITM Ceremony
Legitimate
MITM
User
PC
HTTP(S)
HTTP(S)
a
b
Channel Setup
c
d
e
f
g
6
Conclusion

• Design a great protocol, prove it secure add a
  user, its insecure
• Design a great protocol, prove it secure embed
  it in a larger protocol, its insecure
• These two observations arent just similar
• with Ceremonies, they are the same statement.

7
Think Ceremonies
B
C
D
A