4 ms·
I question your code comprehension. This is not easy to test for at all, and Chrome doesn't do it either. Do you understand how to exploit this issue?
by lawnchair_larry 13y ago
I question your code comprehension. This is not easy to test for at all, and Chrome doesn't do it either. Do you understand how to exploit this issue?
- hueving 13y agoStatic analysis would have caught this immediately. It caused unreachable code that the compiler even recognized and optimized away. You're saying Google Chrome doesn't test that an ephemeral key is actually signed by the cert's private key? If that's the case, that's completely unacceptable because it's the whole point of the protocol.