On Wed, Jan 27, 2010 at 10:41:02PM +, Dr Stephen Henson wrote:
FYI the initial documentation is here:
http://www.openssl.org/docs/ssl/SSL_CTX_set_options.html#SECURE_RENEGOTIATION
there are currently only two flags to set in an SSL/SSL_CTX structure. Though
servers might want to make
--
View this message in context:
http://old.nabble.com/TLS-renegotiation-attack%2C-mod_ssl-and-OpenSSL-tp26215127p27328884.html
Sent from the Apache HTTP Server - Dev mailing list archive at Nabble.com.
On Fri, Nov 06, 2009 at 02:00:47AM +, Dirk-Willem van Gulik wrote:
What we really need is 1) a pub/priv key pair of such a cert* (or use
attached CSR) of some random domain (ideally expired and with a totally
bogus CN valye so we can post the private key publicly) and 2) obviously
a
Joe Orton wrote:
On Fri, Nov 06, 2009 at 12:00:06AM +, Joe Orton wrote:
On Thu, Nov 05, 2009 at 09:31:00PM +, Joe Orton wrote:
* we can detect in mod_ssl when the client is renegotiating by using the
callback installed using SSL_CTX_set_info_callback(), in conjunction
On Tue, Nov 10, 2009 at 03:19:39PM +0100, Jean-Marc Desperrier wrote:
Joe Orton wrote:
On Fri, Nov 06, 2009 at 12:00:06AM +, Joe Orton wrote:
On Thu, Nov 05, 2009 at 09:31:00PM +, Joe Orton wrote:
* we can detect in mod_ssl when the client is renegotiating by using
the
-Original Message-
From: Dirk-Willem van Gulik [mailto:di...@webweaving.org]
Sent: Saturday, November 07, 2009 12:28 AM
To: dev@httpd.apache.org
Subject: Re: TLS renegotiation attack, mod_ssl and OpenSSL
+1 from me. (FreeBSD, Solaris). Test with and without certs (firefox
On 11/09/2009 10:39 AM, Boyle Owen wrote:
-Original Message-
From: Dirk-Willem van Gulik [mailto:di...@webweaving.org]
Sent: Saturday, November 07, 2009 12:28 AM
To: dev@httpd.apache.org
Subject: Re: TLS renegotiation attack, mod_ssl and OpenSSL
+1 from me. (FreeBSD, Solaris
Dirk-Willem van Gulik wrote:
Dirk-Willem van Gulik wrote:
Actually Steve - you may know - what besides the obvious
extendedKeyUsage=nsSGC,msSGC
in the extension file needs to go into a sub-ca below a
self-signed-root-chain to make the browsers dance ? Or have they
hardcoded in some
On Fri, Nov 06, 2009 at 12:00:06AM +, Joe Orton wrote:
On Thu, Nov 05, 2009 at 09:31:00PM +, Joe Orton wrote:
* we can detect in mod_ssl when the client is renegotiating by using the
callback installed using SSL_CTX_set_info_callback(), in conjunction
with suitable flags in the
On 06.11.2009 01:12, Joe Orton wrote:
On Fri, Nov 06, 2009 at 12:00:06AM +, Joe Orton wrote:
FYI - Dirk points out that you can test this using openssl s_client by
entering a line with the single character 'R' which s_client treats as a
command to initiate a renegotiation. Joe
$
So with Joe his patch doing the right thing it seems (would be nice if
we could get Ben or the OpenSSL guys to confirm that) - that we propably
only have the step up 'Server Gated Certs'* let to check.
Does anyone have such a beast for testing ?
or Rick - could you help us here ?
Thanks,
Dirk-Willem van Gulik wrote:
we propably
only have the step up 'Server Gated Certs'* let to check.
Does anyone have such a beast for testing ?
There are two separate types used by Mozilla (Step up?) and Microsoft SSL/TLS
(SGC?) implementations IIRC. One completes the handshake then starts
Andrews, Rick wrote:
https://www.chase.com
https://www.wellsfargo.com
But I suppose you'll need to locate an old international browser that
does step up, right? Most modern browsers will start with strong crypto
and don't need to step up.
What we really need is 1) a pub/priv key pair
Dr Stephen Henson wrote:
There are two separate types used by Mozilla (Step up?) and Microsoft SSL/TLS
(SGC?) implementations IIRC. One completes the handshake then starts a new
session the second cuts it half way through.
Been many years since I looked at those though. I recall having to
Dr Stephen Henson wrote:
There are two separate types used by Mozilla (Step up?) and Microsoft SSL/TLS
(SGC?) implementations IIRC. One completes the handshake then starts a new
session the second cuts it half way through.
Been many years since I looked at those though. I recall having to
Dirk-Willem van Gulik wrote:
Actually Steve - you may know - what besides the obvious
extendedKeyUsage=nsSGC,msSGC
in the extension file needs to go into a sub-ca below a
self-signed-root-chain to make the browsers dance ? Or have they
hardcoded in some specific CA or similar ? Or is there a
Dirk-Willem van Gulik wrote:
Dirk-Willem van Gulik wrote:
Actually Steve - you may know - what besides the obvious
extendedKeyUsage=nsSGC,msSGC
in the extension file needs to go into a sub-ca below a
self-signed-root-chain to make the browsers dance ? Or have they
hardcoded in some
On 11/05/2009 06:32 PM, Joe Orton wrote:
On Thu, Nov 05, 2009 at 03:39:06PM +, Ben Laurie wrote:
Joe Orton wrote:
In the short term, I think it would be useful to have a new SSL_OP_*
flag which enables rejection of a client-initiated handshake in an SSL
server. This will fix the
On Thu, Nov 05, 2009 at 09:38:23PM +0100, Ruediger Pluem wrote:
If server triggered renegotiation will not work at all, people will just
ignore the
update or remove it from 0.9.8l in their self patched versions.
So overall I guess we would be safer with an approach that
1. Turns off
Joe Orton wrote:
* we can detect in mod_ssl when the client is renegotiating by using the
callback installed using SSL_CTX_set_info_callback(), in conjunction
with suitable flags in the SSLConnRec to detect the cases where this is
either a server-initiated renegotiation or the initial handshake
On 11/05/2009 11:03 PM, Dirk-Willem van Gulik wrote:
Joe Orton wrote:
* we can detect in mod_ssl when the client is renegotiating by using the
callback installed using SSL_CTX_set_info_callback(), in conjunction
with suitable flags in the SSLConnRec to detect the cases where this is
On Thu, Nov 05, 2009 at 09:31:00PM +, Joe Orton wrote:
* we can detect in mod_ssl when the client is renegotiating by using the
callback installed using SSL_CTX_set_info_callback(), in conjunction
with suitable flags in the SSLConnRec to detect the cases where this is
either a
On Fri, Nov 06, 2009 at 12:00:06AM +, Joe Orton wrote:
On Thu, Nov 05, 2009 at 09:31:00PM +, Joe Orton wrote:
* we can detect in mod_ssl when the client is renegotiating by using the
callback installed using SSL_CTX_set_info_callback(), in conjunction
with suitable flags in the
23 matches
Mail list logo
