10 ms·
And in the world of TLS, this is called a downgrade attack and treated as a serious problem...
by mmagin 10y ago
And in the world of TLS, this is called a downgrade attack and treated as a serious problem...
- vog 10y agoIndeed! A very good advice that read on this topic was this one: As a rule of thumb, any security protocol that contains lots of "MAY" parts (options) in its specification is suspicious. Even more so if the security layer itself is optional. Ideally, a security protocol contains no "MAY" parts, not even "SHOULD" parts, but only "MUST" parts. (Not sure where I read this, or who wrote that. So I'm paraphrasing it here. Maybe it's common sense without a single attributable source.)