The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
73 views

Would disabling resumption/renegotiation mitigate the triple handshake issue?

The Triple Handshake Issue was disclosed lately. As far as I understand it, it highly depends on renegotiation and resumption. So the simple question is: Would disabling resumption and/or ...
5
votes
2answers
2k views

Not clear on ssl renegotiation vulnerabilty

When we read about TLS Renegotiation vulnerability, does it mean that a server is not supposed to ever accept renegotiation during a secure connection? I thought that by renegotiation security is ...
9
votes
6answers
5k views

Is MD5 considered insecure?

After all these articles circulating online about md5 exploits, I am considering switching to another hash algorithm. As far as I know it's always been the algorithm of choice among numerous DBAs. Is ...
5
votes
3answers
650 views

TLS Renegotiation Indication Extension vulnerability

I am trying to understand the TLS Renegotiation Indication Extension from the RFC. I can understand that it is related to the fact that the renegotiation is sent under the encrypted stream, but I ...
6
votes
1answer
680 views

How has TLS renegotiation been fixed?

I've read RFC 5746 on the TLS secure renegotiation extension. However, I don't understand how it fixes the problem. Client and server are required to include the verify_data from the previous ...