Stanford University researchers David Brumley and Dan Boneh have implemented an attack on SSL/TLS servers that was first proposed (if I'm not mistaken) by Paul Kocher in 1996. This timing attack can reveal the private RSA key in SSL/TLS servers that do not take steps to prevent it. The Stanford researchers have shown that this timing attack is practical against real-world network servers. The researchers' full paper on this subject may be seen at http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf This is also being discussed on slashdot.
NSS is not vulnerable to this attack. NSS is the SSL software used in all Netscape Enterprise Server (NES) and in iPlanet Web Server (iWS) products and in the mozilla and Netscape browsers. NSS employs the proper counter-measures to this attack, and has done so for at least 5 years now. So, administrators of NSS-based servers can breathe a sigh of relief. Disclaimer: Views and opinions expressed here are my own. I am not speaking officially on behalf of Netscape, AOL or Sun. -- Nelson Bolyard
