3 ms·
Not to mention that you have to trust the endpoint to ship their session keys. If one "forgets" or the key is "lost in the mail", there's no way to prove that
by bmm6o 8y ago
Not to mention that you have to trust the endpoint to ship their session keys. If one "forgets" or the key is "lost in the mail", there's no way to prove that message wasn't problematic.
- deathanatos 8y agoAssume that non-PFS ciphersuites had remained in TLS: You still have to trust the endpoint to not negotiate a PFS ciphersuite.
- cbsmith 8y agoYes, but a failure to do so would be considered a compromise, as opposed to a simple network failure.