Questions tagged [tls-downgrade]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
23 votes
3 answers
26k views

Should I use SSL/TLS renegotiation?

Should I use SSL/TLS renegotiation? In other words: does SSL/TLS renegotiation enhance or weaken the security?
Jim's user avatar
  • 381
11 votes
1 answer
14k views

Is TLS_FALLBACK_SCSV useless if only TLS (1.0, 1.1, 1.2) is supported?

Ssllabs does not give A+ (highest) rating if the server does not support TLS_FALLBACK_SCSV to prevent downgrade attack. But I am wondering, is it really any useful if the server legitimately provide ...
Ilya Chernomordik's user avatar
2 votes
2 answers
1k views

TLS downgrade attacks

I'm currently looking at e-mail security and wondered whether server to server e-mail communication that enforces TLS, will prevent the risk of TLS downgrade attacks?
Chri3's user avatar
  • 327
2 votes
1 answer
289 views

Why TLS does not sign ciphersuite?

TLS negotiates a ciphersuite and TLS version to use during handshake. It confirms the handshake was not tampered with and the ciphersuite and TLS version were not downgraded using the negotiated ...
Peter Harmann's user avatar
1 vote
1 answer
203 views

SSL - Does Change_cipher protects against downgrade ?

An excerpt of one of my courses about SSL/TLS says the following, This excerpt is just after the Handshake finish phase of SSL (with change_cipher_spec and finished messages). Role of the finish ...
Arthur Attout's user avatar