SSL Threat Model
SSL is easy to use but also very easy to use incorrectly. The ecosystem, which is built of the specifications, the implementations, the CAs and the PKI, is full of traps, each of which is very easy to fall into. Once I started to spend significant time thinking about SSL I set out to build a model of the ecosystem, for my own education and to ensure that I understand it all. That's how I arrived to the SSL Threat Model. The image is too big to include here, but just click on the link below to get it:
- SSL Threat Model (PNG, 65 KB)
I do understand that many of the elements in the model need explanations, but the diagram is all I have at the moment. As a matter of fact, the diagram has been sitting in my virtual drawer for months in the hope that I would eventually accompany it with some documentation. But seeing that the documentation is not going to happen any time soon, I decided to go ahead and publish the diagram alone.
Feel free to post comments here, though!
I know what you mean ... models get bigger and bigger ... and then the blog provider doesn't let you publish stuff coz it is insecure!
BTW, I am trying to reference this blog post from my site; is there a HTML entity I can use for you name?
Posted by: Iang (browser attack tree from 2004) | September 09, 2009 at 11:37 PM
Don't worry about the correct entity. A humble c is perfectly fine. (The character's code is 0x107, by the way.) I'll have to compare your map to mine to make sure I am not missing anything.
Posted by: Ivan Risti | September 11, 2009 at 08:51 AM
What software did you use to create the nice threat model tree?
Posted by: Robin | October 16, 2009 at 05:55 AM
Robin, I used FreeMind -- http://freemind.sourceforge.net
Posted by: Ivan Ristic | October 16, 2009 at 03:25 PM
Nice mindmap Ivan. I am not sure if you know but it is possible to upload a map to the FreeMind gallery and have it viewable by a flash plug-in. The link is
http://freemind.sourceforge.net/wiki/index.php/Mind_Map_Gallery
and I have put quite a few maps under the technology, section 1.1.
rgs Luke
Posted by: Luke O'Connor | December 01, 2009 at 09:30 PM
Thanks Luke, I didn't know that. The Flash viewer looks very useful; I will look into it.
Posted by: Ivan Ristic | December 04, 2009 at 12:19 PM