3 ms·

FYI -- the source code here is public. Didn't help :D

• sneak 13y ago
  It helped us realize how easy it would be to test for this, and that Apple isn't.
  • lawnchair_larry 13y ago
    I question your code comprehension. This is not easy to test for at all, and Chrome doesn't do it either. Do you understand how to exploit this issue?
    • hueving 13y ago
      Static analysis would have caught this immediately. It caused unreachable code that the compiler even recognized and optimized away. You're saying Google Chrome doesn't test that an ephemeral key is actually signed by the cert's private key? If that's the case, that's completely unacceptable because it's the whole point of the protocol.