Skip to main content

Insecure encryption algorithm - SSL/TLS

Need​

Implementation of secure encryption algorithms for SSL/TLS

Context​

  • Usage of Swift 5.0 for iOS app development
  • Usage of Foundation for building responsive and accessible web interfaces

Description​

Non compliant code​

import Foundation

let url = URL(string: "https://example.com")!
let request = URLRequest(url: url)

let sessionConfig = URLSessionConfiguration.default
sessionConfig.requestCachePolicy = .reloadIgnoringLocalCacheData
sessionConfig.urlCache = nil

// Here is the vulnerability, we are using an insecure TLS version
sessionConfig.tlsMinimumSupportedProtocol = SSLProtocol.tlsProtocol12

let session = URLSession(configuration: sessionConfig)

let task = session.dataTask(with: request) { (data, response, error) in
    if let error = error {
        print("Error: \\(error)")
    } else if let data = data {
        let str = String(data: data, encoding: .utf8)
        print("Received data:\\n\\(str ?? "")")
    }
}
task.resume()

In the above Swift code, the URLSessionConfiguration is configured to use an insecure version of the TLS protocol (SSLProtocol.tlsProtocol12). This insecure protocol can lead to vulnerabilities where an attacker could potentially eavesdrop on the encrypted communication, leading to data leaks and breaches.

This is particularly dangerous if the application is dealing with sensitive information such as user credentials, payment information, or any other personally identifiable information (PII).

The best practice is to use the most secure and latest version of TLS, which as of now is TLS 1.3. This can be done by setting sessionConfig.tlsMinimumSupportedProtocol to SSLProtocol.tlsProtocol13. This ensures that the application uses a secure protocol for its network communications, reducing the risk of data breaches and leaks.

Steps​

  • Update the TLS protocol version to a secure version, such as TLS 1.2 or higher.
  • Remove the line 'sessionConfig.tlsMinimumSupportedProtocol = SSLProtocol.tlsProtocol12'.
  • Ensure that the server supports the updated TLS protocol version.
  • Consider using a secure encryption algorithm, such as AES, for data encryption.
  • Regularly update the SSL/TLS library used in the application to the latest version to address any security vulnerabilities.

Compliant code​

import Foundation

let url = URL(string: "https://example.com")!
let request = URLRequest(url: url)

let sessionConfig = URLSessionConfiguration.default
sessionConfig.requestCachePolicy = .reloadIgnoringLocalCacheData
sessionConfig.urlCache = nil

// Updated to a secure TLS version
sessionConfig.tlsMinimumSupportedProtocol = .tlsProtocol13

let session = URLSession(configuration: sessionConfig)

let task = session.dataTask(with: request) { (data, response, error) in
    if let error = error {
        print("Error: \\(error)")
    } else if let data = data {
        let str = String(data: data, encoding: .utf8)
        print("Received data:\\n\\(str ?? "")")
    }
}
task.resume()

The previous code was vulnerable due to the use of an insecure TLS protocol version (TLS 1.2). This could potentially expose sensitive data to attackers who are capable of exploiting known vulnerabilities in these older protocols.

The updated code fixes this vulnerability by specifying a secure TLS protocol version (TLS 1.3) in the URLSessionConfiguration. This ensures that the connection between the client and server is encrypted using a secure protocol, reducing the risk of data exposure.

In addition to this, it's important to ensure that the server supports the updated TLS protocol version. If the server only supports older, insecure versions, the client will not be able to establish a secure connection.

Furthermore, consider using a secure encryption algorithm, such as AES, for data encryption. This provides an additional layer of security for the data being transmitted.

Lastly, it's crucial to regularly update the SSL/TLS library used in the application to the latest version. This helps to address any security vulnerabilities that may have been discovered in older versions of the library.

References​

Last updated on