1

As per my knowledge the current implementation of SSL/TLS does not have the capability to identify the data is malicious or not during the transmission or before encrypt the data. If its have , kindly do let me know.

If its not having the trend of identifying of it, then what's wrong on going it that to implement in such a way to get the same time as current SSL/TLS working now ?

Improve this question
1
  • SSL/TLS has nothing to do with detection of malicious 'things'. That isn't what it is for.
    – Rory Alsop ♦
    Jan 28, 2015 at 11:45

1 Answer 1

Reset to default
1

As per my knowledge the current implementation of SSL/TLS does not have the capability to identify the data is malicious or not during the transmission or before encrypt the data. If its have , kindly do let me know.

SSL/TLS is just for transport of the data and has no idea of what the data are for. Therefore it can and will not detect "malicious things", whatever these are. But it can detect somebody trying to sniff or manipulate the traffic in between sender and recipient.

If its not having the trend of identifying of it, then what's wrong on going it that to implement in such a way to get the same time as current SSL/TLS working now ?

Proper detection of "malicious things" can only be achieved if the attacker sets the security flag as defined per RFC 3514. But please note that this is only defined for IPv4 for now. Please also note the date this RFC was issued.

Improve this answer
4
  • My scenario here is why the detection cannot be implemented during the transport of data. If so, it will be an major feature for many users.
    – user45475
    Jan 28, 2015 at 6:49
  • Of course one can implement detection before encryption of after decryption. But this is outside the SSL/TLS protocol itself, which only deals with secure encrypted and tamper-resistant transport. Anybody trying to analyze traffic during transport must mount a man-in-the-middle attack (bad) or do SSL interception (same thing but good) to get to the plain data. This interception will be detected.
    – Steffen Ullrich
    Jan 28, 2015 at 6:51
  • But during the transport of data , it is confidential between the sender and receiver. Because now days ,attackers sends an encrypted file ( for example SMIME ) and it leads to some damage even we use the proper secure communication too
    – user45475
    Jan 28, 2015 at 6:59
  • Think of SSL/TLS as an envelope around the message. The envelope itself deals only with protecting against an attacker which tries to look at the message or manipulate it. The envelope itself has no way to even decide if the message is malicious. Only sender and recipient can see the plain message and thus decide if it is bad. And anybody in between client and sender must destroy the envelope to verify the message and then needs to put the message into a new envelope. This change will be detected by the client because each envelope is signed in a way which can not be forged.
    – Steffen Ullrich
    Jan 28, 2015 at 7:13

Not the answer you're looking for? Browse other questions tagged .