101 reputation
4
bio website yuhongbao.blogspot.com
location
age 21
visits member for 3 years, 9 months
seen May 24 at 18:47

Apr
21
revised FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?
edited body
Mar
10
comment In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
Yea, most browsers disabled them years ago.
Mar
10
comment In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
You forgot that once the master secret is obtained, the Finished hash can be forged. As such I think 512-bit DHE probably is affected.
Mar
10
answered FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?
Mar
9
comment In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?
2000, not 1996.
Jan
29
answered RC4 support in SSL configuration
Jan
22
comment What was so dangerous about PGP that its creator was charged in court for it?
FYI, it was in 1992 that the infamous 40-bit key length limit for the RC2 and RC4 algorithms was set (by a deal between the NSA and the SPA). You used a Commodity Jurisdiction in which they added special fast track processes for encryption review.
Jan
10
comment Which SSL/TLS ciphers can be considered secure?
Also the only non-export cipher suites that uses MD5 also uses RC4, which has its own problems too. Both RC4 and 3DES can be disabled if you don't need to support legacy clients like WinXP's SChannel.
Jan
4
comment What happens when certificates further up the chain expires before mine? (Equifax/GeoTrust)
As a side note, I think the Android browser uses OpenSSL.
Jan
4
awarded  Supporter
Jan
4
awarded  Commentator
Jan
4
comment What happens when certificates further up the chain expires before mine? (Equifax/GeoTrust)
The OpenSSL trunk has a -trusted_first option which fixes this problem, and some distros have backported it I think. There is an OpenSSL bug about making it the default.
Dec
28
answered When do governments allow export of cryptography software?
Dec
28
suggested rejected edit on Export ciphers prevalance
Dec
28
answered Why have export controls for cryptography?
Dec
27
comment How did SSLv3 get AES?
Actually, SSLv3 was published in Internet-Drafts which most people that implemented SSLv3 used.
Dec
27
comment How did SSLv3 get AES?
Interestingly MS's SChannel don't support it: blogs.msdn.com/b/ieinternals/archive/2009/12/08/…
Dec
4
comment Why do browsers probe and fallback (or, why SSL_MODE_SEND_FALLBACK_SCSV)?
Actual support for TLS 1.1 and later however is different from performing the TLS version negotiation correctly.
Nov
30
comment What does 2^77.1 calls presented in a SHA1 attack mean?
I wonder how fast a FPGA would be.
May
22
comment Is it a security risk to maintain an application developed for a version of .NET prior to 4.0?
Service packs for 3.5, 3.0, and 2.0 are developed together and 3.5 and 3.0 only provides additional components to layer on top of 2.0. 3.5 SP1 has 3.0 SP2 and 2.0 SP2 inside for example.