3 ms·
Actually, TLS cipher suite negotiaion has been a lifesaver for mitigating recent attacks. http://www.phonefactor.com/resources/CipherSuiteMitigationForBeast.pdf
by marshray 14y ago
Actually, TLS cipher suite negotiaion has been a lifesaver for mitigating recent attacks. http://www.phonefactor.com/resources/CipherSuiteMitigationForBeast.pdf http://www.phonefactor.com/resources/CipherSuiteMitigationFo...
Unless you're referring to SSLv2 or home-rolled nonstandard downgrade logic invented by browser vendors, modern TLS is pretty good at preventing ciphersuite downgrade attacks.
If a single standard had been specified it would have been some minor variant of AES-CBC-HMAC<SHA>. We know of several ways to attack that combination now.
- tptacek 14y agoAh-ah! We know several ways to attack poor implementations of that combination now. AES-CBC with HMAC is still sound.
- marshray 14y agoWhere "poor implementations" = "just about about all of them, ever, except those patched in the last 24 months".
- tptacek 14y agoAre you arguing that AES-CBC + HMAC is NOT a sound construction, or are you just augmenting my comment with more information?
- marshray 14y agoI'm not sure. I think I'm saying that a "formally proven sound" construction that is full of poorly understood traps for the implementer on actual machines is not always the best choice in practice.
- tptacek 14y agoAbsurdly intelligent and well-informed crypto people have screwed up CTR mode before.
- marshray 14y agoYep. I think we can go farther than that and say that it's been historically screwed up by protocol designers and/or implementers more often than not (with predictable IVs, timing and length oracles, MAC-then-encrypt, etc)