3 ms·
I know this timeline prefers primary sources and tries to avoid blog posts, but Cloudflare's blog post 'Staying on top of TLS attacks' [1] dated July 11, 2013,
by niftich 10y ago
I know this timeline prefers primary sources and tries to avoid blog posts, but Cloudflare's blog post 'Staying on top of TLS attacks' [1] dated July 11, 2013, was a milestone.
It came in the wake of 'Lucky 13' and the demonstration of RC4 biases exploitable in TLS, and showed the awkward situation that existed at the time: essentially all supported ciphersuites were vulnerable to something, and no mainstream browser supported TLSv1.2 yet in which non-vulnerable ciphersuites were present.
Even if a reference isn't made to the blog post, the timeline should somehow reference the aforementioned ciphersuite conundrum.
[1] https://blog.cloudflare.com/staying-on-top-of-tls-attacks/ https://blog.cloudflare.com/staying-on-top-of-tls-attacks/
- tptacek 10y agoI don't think this blog post broke that news: it pretty much follows directly from Lucky 13 and RC4, both of which are documented in the timeline. It would be pretty weird to add a blog post about two other things in the timeline to the timeline itself.
- niftich 10y agoI suppose you're right. The timeline avoids editorializing but at the same time tries to inform, and in my opinion it would be valuable to inform that from March 2013 until Chrome shipped TLSv1.2 in August 2013, there was no good cipher to pick that didn't have an exploit. As it stands now you have to combine different pieces of information, some already included in the timeline (RC4, Lucky 13, Chrome TLSv1.2), some you have to know by knowing what's in TLSv1.1 and what's not (yet) in it.
- tptacek 10y agoI also don't think it's a great idea to open up the can of worms about whether "no viable TLS ciphersuites" began with Lucky 13 or with RC4 (which depends on whether you think the most recent RC4 paper was the death knell for RC4, or whether the Fluhrer-McGrew biases were).