[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: TLS Man-In-The-Middle Vulnerability

To: or-talk <or-talk@xxxxxxxxxxxxx>
Subject: Re: TLS Man-In-The-Middle Vulnerability
From: Marcus Griep <tormaster@xxxxxxx>
Date: Thu, 5 Nov 2009 15:46:28 -0500
Delivered-to: archiver@xxxxxxxx
Delivered-to: or-talk-outgoing@xxxxxxxx
Delivered-to: or-talk@xxxxxxxx
Delivery-date: Thu, 05 Nov 2009 15:46:52 -0500
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:sender:received:in-reply-to :references:from:date:x-google-sender-auth:message-id:subject:to :content-type; bh=rOSUS1nLWq8WmhGRPi5Ng2sz9YyNTzHieY6yKhE+6fg=; b=gyS2vQuycuJatoPd3Z5st5Z7dKdKYDnIqs8W0ezSUnT29ALffkQ/pPaS4vxZiwwGAa p0AG46QL7y1RZcTRAAphhxCBwzRlmuWtwVDRlBVjvv1UQ6X5Vx+0OIZ8BwUbefmPhniN Kpokg+Fv7k7LYzWKafIySNoOvE1iq67AapXWI=
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:from:date :x-google-sender-auth:message-id:subject:to:content-type; b=v+m/CLHwvVyNIISCUuH+FmLPKcQaeiEv5dqBD3/hg/Bq0g+6tk2LzuNq3PnbW54C59 mk4e4e6sGlcwDlKjeb1mg/DTt/s9hpcVuj5C4F4uf/clnCl5RSIIgp6mty736oZM/XW6 5fdYGnIXjIFGgPIFFn5dY+EmUoXP6Kfb2aD9c=
In-reply-to: <347507080911051110k77753887vf5a187502a13a60a@xxxxxxxxxxxxxx>
References: <347507080911051110k77753887vf5a187502a13a60a@xxxxxxxxxxxxxx>
Reply-to: or-talk@xxxxxxxxxxxxx
Sender: owner-or-talk@xxxxxxxxxxxxx

The ITEF Network Working Group has already begun drafting a new extension to TLS: Renegotiation Indication.

https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt
--
Marcus Griep
——
Ακακια את.ψο´, 3°

On Thu, Nov 5, 2009 at 2:10 PM, Marcus Griep <tormaster@xxxxxxx> wrote:

Don't know if any one else has seen or taken a look at this. I don't know if this affects Tor, though I believe that we do use certificate renegotiation in the protocol, and that is the entry vector for this particular vulnerability:

"TLS Man-in-the-middle on renegotiation vulnerability made public"
http://isc.sans.org/diary.html?storyid=7534
--
Marcus Griep
——
Ακακια את.ψο´, 3°

References:
- TLS Man-In-The-Middle Vulnerability
  - From: Marcus Griep

Prev by Author: TLS Man-In-The-Middle Vulnerability
Next by Author: Re: Reduce hops when privacy level allows to save Tor network bandwidth
Previous by thread: TLS Man-In-The-Middle Vulnerability
Next by thread: Re: TLS Man-In-The-Middle Vulnerability
Index(es):
- Author
- Thread