Before the third handshake, server Alice has to require a session renegotiation, including client authentication, on its connection with Mallory, possibly in response to Mallory’s request for some restricted resource. [...]
20.8 Triple Handshake attack In the Triple Handshake attack [29], an attacker posing as a man-in-the-middle causes two separate TLS connections, namely one from client Bob to attacker Mallory and [...]
21.4 Sweet32 SWEET32 [30] is a generic attack against block ciphers with a block size of 64 bits in CBC mode, such as DES or 3DES. However, it has special [...]
21.5.1 Lossless compression algorithms In a lossless compression algorithm, the input data is encoded in such a way that its length is decreased. After decoding, however, all of the input [...]
21.5.2 The compression side channel Back in 2002, John Kelsey, a cryptographer working for Certicom at that time, published a paper [98] describing how lossless data compression, when used in [...]
21.5.3 Brief history of compression in TLS Both TLS version 1.0 released in 1999 [47] and TLS version 1.1 released in 2006 [48] specify compression for TLS records. One of [...]
22.4 Heartbleed In 2014, Google’s security team member Neel Mehta privately reported an implementation bug to OpenSSL’s developer team. The same bug was independently discovered by security engineers working for [...]
22.4.2 The Heartbleed bug Heartbleed is the result of improper input validation – more precisely, a missing bounds check – in the OpenSSL implementation of the TLS Heartbeat extension. Technically, [...]
22.4.3 The bugfix The bugfix for the Heartbleed bug is shown in Listing 22.3. It is a simple bounds check using the actual TLS record length in the s3-¿rrec data [...]
22.9.1 Side channel attacks In side channel attacks, Eve exploits information that the implementation of a cryptographic algorithm leaks through so-called side channels. Side channels are observable physical quantities, such [...]