The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
2answers
114 views

Why do browsers probe and fallback (or, why SSL_MODE_SEND_FALLBACK_SCSV)?

I've been following POODLE and the SSL_MODE_SEND_FALLBACK_SCSV TLS extension. I never really paid much attention to it, but it appears SSL_MODE_SEND_FALLBACK_SCSV is needed for clients like browsers ...
1
vote
1answer
88 views

Would disabling resumption/renegotiation mitigate the triple handshake issue?

The Triple Handshake Issue was disclosed lately. As far as I understand it, it highly depends on renegotiation and resumption. So the simple question is: Would disabling resumption and/or ...
6
votes
2answers
3k views

Not clear on ssl renegotiation vulnerabilty

When we read about TLS Renegotiation vulnerability, does it mean that a server is not supposed to ever accept renegotiation during a secure connection? I thought that by renegotiation security is ...
10
votes
6answers
7k views

Is MD5 considered insecure?

After all these articles circulating online about md5 exploits, I am considering switching to another hash algorithm. As far as I know it's always been the algorithm of choice among numerous DBAs. Is ...
5
votes
3answers
754 views

TLS Renegotiation Indication Extension vulnerability

I am trying to understand the TLS Renegotiation Indication Extension from the RFC. I can understand that it is related to the fact that the renegotiation is sent under the encrypted stream, but I ...
6
votes
1answer
709 views

How has TLS renegotiation been fixed?

I've read RFC 5746 on the TLS secure renegotiation extension. However, I don't understand how it fixes the problem. Client and server are required to include the verify_data from the previous ...