Re: [TLS] TLS or HTTP issue? (was: TLS renegotiation issue)

[Nicolas Williams <Nicolas.Williams at sun.com>]

This vulnerability will affect different application protocols
differently.  It certainly affects HTTP.  I think LDAP may not be
susceptible, but I'm not sure; I'm even less sure about IMAP.  Others
have indicated that there definitely exist other applications besides
HTTP which do suffer from this vulnerability though, and that's the key:
of course there may be more than one application protocol that is made
vulnerable by this TLS problem.

We must fix this problem in TLS itself.  The fix may require changes to
some applications, depending not so much on the protocol as on the TLS
API used.

Nico
--