Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [secure-renegotiation]

The tag has no usage guidance.

3
votes
0answers
87 views

Does RenegotiateOnce in Go's crypto/tls package protect against triple handshake?

Looking into how to do client cert authentication from the Go HTTP client, I found out I needed renegotiation from the client side and I came across issue 5742 for Go on GitHub, which is the issue ...
0
votes
1answer
383 views

renegotiated master key in openssl s_client

OpenSSL c_client (CLI) prints the Master-Key during initial handshake. This can be clubbed with client random to decrypt packet capture in Wireshark. However, the random and master key changes after ...
1
vote
1answer
499 views

Inducing TLS renegotiation

Is it possible to induce ssl renegotiation for a browser via command line / a curl request. I know it is possible to rate limit ssl renegotiation but do not know how to do it the other way around. I ...
1
vote
1answer
875 views

Does subject alternative name order matter for TLS certificates?

I ran into an issue today and I'm interested in finding out if the behaviour seen is standard or non standard. We have several servers that are exposed through a load balancer serving https requests. ...
4
votes
0answers
458 views

Should I force Thunderbird to avoid RFC5746 and CVE-2009-3555 security bugs?

I see that the latest version of Thunderbird (38.0.1) still has the defaults set to ignore the error. Is this a big problem? Should I change the defaults to enforce greater security? Here is ...
10
votes
2answers
23k views

How can you check and analyze SSL ports other than 443?

I tried https://www.ssllabs.com/ssltest/analyze.html?d=imap.spamarrest.com%3A993&hideResults=on but it said Ports other than 443 not supported I need to check imap.spamarrest.com:993
0
votes
1answer
69 views

Questions about “Triple Handshakes Considered Harmful Breaking and Fixing Authentication over TLS”

Recently I'm reading the paper "Triple Handshakes Considered Harmful Breaking and Fixing Authentication over TLS", and I have several questions unclear. First question: In TLS 1.2 standard, we can ...
0
votes
1answer
410 views

Triple handshake attack against TLS

Triple handshake attack was discovered lately, and to quote the article "The secure renegotiation indication extension only binds handshakes on the same connection, but does not apply if the session ...
1
vote
1answer
429 views

TLS: could the resumed session and the original session in the same connection?

In tls 1.2, we know that every connection is associated with one session, and session resumption can be used to establish a new connection quickly by using the session ID of the original session of an ...
4
votes
0answers
3k views

Java Updates Restrict Unsafe SSL Renegotiation With Active Directory Servers

We have two active directory (AD) hosts, ead01.domain.com and ead02.domain.com; we also have a corresponding service domain, at eadauth.domain.com which round-robins between these AD hosts (via DNS). ...
2
votes
3answers
8k views

Is it possible to upgrade the SSL version of a connection from the server's side only?

I am trying to find out if there's a way to upgrade the SSL version from SSLv3 to TLSv1 of a connection by only making server-side changes. In my case, both the client application and server are ...
4
votes
2answers
1k views

Why do browsers probe and fallback (or, why SSL_MODE_SEND_FALLBACK_SCSV)?

I've been following POODLE and the SSL_MODE_SEND_FALLBACK_SCSV TLS extension. I never really paid much attention to it, but it appears SSL_MODE_SEND_FALLBACK_SCSV is needed for clients like browsers ...
1
vote
2answers
244 views

Would disabling resumption/renegotiation mitigate the triple handshake issue?

The Triple Handshake Issue was disclosed lately. As far as I understand it, it highly depends on renegotiation and resumption. So the simple question is: Would disabling resumption and/or ...
13
votes
2answers
9k views

Should I use SSL/TLS renegotiation?

Should I use SSL/TLS renegotiation? In other words: does SSL/TLS renegotiation enhance or weaken the security?
80
votes
7answers
81k views

Is MD5 considered insecure?

After all these articles circulating online about md5 exploits, I am considering switching to another hash algorithm. As far as I know it's always been the algorithm of choice among numerous DBAs. Is ...
5
votes
3answers
2k views

TLS Renegotiation Indication Extension vulnerability

I am trying to understand the TLS Renegotiation Indication Extension from the RFC. I can understand that it is related to the fact that the renegotiation is sent under the encrypted stream, but I ...
6
votes
1answer
1k views

How has TLS renegotiation been fixed?

I've read RFC 5746 on the TLS secure renegotiation extension. However, I don't understand how it fixes the problem. Client and server are required to include the verify_data from the previous ...