Re: [TLS] [oss-security] CVE-2009-3555 for TLS renegotiation MITM attacks

To: oss-security at lists.openwall.com
Subject: Re: [TLS] [oss-security] CVE-2009-3555 for TLS renegotiation MITM attacks
From: ArkanoiD <ark at eltex.net>
Date: Mon, 9 Nov 2009 00:54:43 +0300
Cc: tls at ietf.org
Delivered-to: tls at core3.amsl.com
In-reply-to: <Fsm81lMN44X1vIl54+7dGMNZAWM at W35zwFHQJD9TSf5n3XGjbHLrnqQ>
List-archive: <http://www.ietf.org/mail-archive/web/tls>
List-help: <mailto:tls-request@ietf.org?subject=help>
List-id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-post: <mailto:tls@ietf.org>
List-subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
List-unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
References: <0911051520390.27904 at mjc.redhat.com> <Fsm81lMN44X1vIl54+7dGMNZAWM at W35zwFHQJD9TSf5n3XGjbHLrnqQ>
User-agent: Mutt/1.4.2.3i

BTW renegotiation handshake looks quite similar to initial handshake from
the client point of view; is there a way to detect the attack on client side
and drop the connection?

Follow-Ups:
- Re: [TLS] [oss-security] CVE-2009-3555 for TLS renegotiation MITM attacks
  - From: Marsh Ray

References:
- Re: [TLS] [oss-security] CVE-2009-3555 for TLS renegotiation MITM attacks
  - From: Eygene Ryabinkin

Prev by Date: Re: [TLS] Implementing https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegot iate.txt
Next by Date: Re: [TLS] TLS renegotiation issue
Previous by thread: Re: [TLS] [oss-security] CVE-2009-3555 for TLS renegotiation MITM attacks
Next by thread: Re: [TLS] [oss-security] CVE-2009-3555 for TLS renegotiation MITM attacks
Index(es):
- Date
- Thread

Re: [TLS] [oss-security] CVE-2009-3555 for TLS renegotiation MITM attacks

Note: Messages sent to this list are the opinions of the senders and do not imply endorsement by the IETF.