User: Password:
Subscribe / Log in / New account

TLS renegotiation vulnerability

TLS renegotiation vulnerability

Posted Nov 19, 2009 7:56 UTC (Thu) by agl (guest, #4541)
Parent article: TLS renegotiation vulnerability

Ben Laurie and I know each other and our respective blog postings make us
look much more pugnacious than we actually are :)

My post was written before the full details of the issue were out (or, at
least, before I had seen them) and I was concerned that pinpointing the
problem within TLS precluded a needed discussion about how to prevent this in
future. I still think this is true, and Ben agrees with the need to think
about this problem more deeply. This was one of those cases where each
component seemed secure (with their respective, though possibly mistaken,
assumptions), but the system as a whole clearly wasn't.

As the moment, however, people are still scrambling to plug the leak so we
should thank those volunteers who are doing so.

(Log in to post comments)

Copyright © 2018, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds