Skip to main content

Questions tagged [secure-renegotiation]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
106 votes
7 answers
141k views

Is MD5 considered insecure?

After all these articles circulating online about md5 exploits, I am considering switching to another hash algorithm. As far as I know it's always been the algorithm of choice among numerous DBAs. Is ...
Tawfik Khalifeh's user avatar
4 votes
2 answers
2k views

Why do browsers probe and fallback (or, why SSL_MODE_SEND_FALLBACK_SCSV)?

I've been following POODLE and the SSL_MODE_SEND_FALLBACK_SCSV TLS extension. I never really paid much attention to it, but it appears SSL_MODE_SEND_FALLBACK_SCSV is needed for clients like browsers ...
user avatar
23 votes
3 answers
27k views

Should I use SSL/TLS renegotiation?

Should I use SSL/TLS renegotiation? In other words: does SSL/TLS renegotiation enhance or weaken the security?
Jim's user avatar
  • 381
1 vote
1 answer
1k views

Triple handshake attack against TLS

Triple handshake attack was discovered lately, and to quote the article "The secure renegotiation indication extension only binds handshakes on the same connection, but does not apply if the session ...
xinyu's user avatar
  • 52
0 votes
1 answer
450 views

Questions about "Triple Handshakes Considered Harmful Breaking and Fixing Authentication over TLS"

Recently I'm reading the paper "Triple Handshakes Considered Harmful Breaking and Fixing Authentication over TLS", and I have several questions unclear. First question: In TLS 1.2 standard, we can ...
xinyu's user avatar
  • 52