[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

TLS renegotiation MITM

From: Steve Dispensa
Subject: TLS renegotiation MITM
Date: Wed, 04 Nov 2009 21:53:38 -0600
User-agent: Microsoft-Entourage/


A colleague and I have released details of a new attack against TLS in the
area of renegotiation. Information is here:

During the process of running this bug (and its proposed solution) to
ground, I implemented a patch to GNUTLS, attached. There are also two new
files that implement the extension that solves the problem.

There is lots of background in the above link, but the one missing part is
the Internet Draft that has been tentatively agreed on by most of the major
vendors (pending IETF action, of course). That draft is what I have
implemented, and you should see it posted to the TLS IETF list tomorrow

I'd be happy to help in any way I can.



Attachment: ext_safe_renegotiation.c
Description: Binary data

Attachment: ext_safe_renegotiation.h
Description: Binary data

Attachment: gnutls-safe-renegotiation.patch
Description: Binary data

reply via email to

[Prev in Thread] Current Thread [Next in Thread]