IETF Fix For SSL Protocol Complete

    Date13 Jan 2010
    Posted ByAnthony Pell
    The Internet Engineering Task Force (IETF) has completed a security extension to the Secure Sockets Layer (SSL) protocol that fixes a flaw affecting browsers, servers, smart cards, and VPN products, as well as many lower-profile devices, such as Webcams, that contain the protocol embedded in their firmware. Members of the IETF, the Industry Consortium for the Advancement of Security on the Internet, and several vendors, including Google, Microsoft, and PhoneFactor, have been working on a fix since October for the bug, which is basically a gap in the authentication process that lets an attacker execute a man-in-the-middle (MITM) attack and inject his own text into the encrypted SSL connection. The gap occurs in the renegotiation process of the session, when some applications require the encryption process be refreshed at a certain point.

    Marsh Ray, a senior software development engineer for PhoneFactor who first discovered the SSL bug in August, says the IETF's extension to SSL, which is the Transport Layer Security (TLS) protocol in IETF parlance, secures the renegotiation process.

    "This is a short extension to the handshake protocol of TLS," Ray says. "Some identifiers from the previous session are carried over to the handshake in the subsequent session."

    You are not authorised to post comments.

    LinuxSecurity Poll

    Has your email account ever been pwned in a data breach?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 2 answer(s).

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.