Kyle Rose <[email protected]> writes: >A large attack surface can't be avoided with the MTI for these protocols.
It can be vastly reduced by only implementing the MTI rather than every possible bell and whistle in existence. Also since an RTU (remote terminal unit) doesn't need to talk to every single piece of broken software on the planet but only what the master station it's talking to is running, all you need is whatever the de facto universal standard config is, either DH+RSA+AES or P256 ECDH/ECDSA+AES and nothing else, no suite negotiation, no extensions, nothing. And that goes all the way up and down the protocol stack. TCP options, fragmentation, UDP, ICMP, packet reordering, most flow control and congestion avoidance, none of that's there. Fuzzing these things is mostly a waste of time because there's no alternate code paths or corner cases to discover in the fuzzing. Makes them remarkably resistant to attack because there's very little there to attack. Peter. _______________________________________________ TLS mailing list [email protected] https://www.ietf.org/mailman/listinfo/tls
