Before the third handshake, server Alice has to require a session renegotiation, including client authentication, on its connection with Mallory, possibly in response to Mallory’s request for some restricted resource. [...]
21.1 Lucky 13 In 2013, Nadhem AlFardan and Kenneth Paterson, two researchers from the Information Security Group at Royal Holloway, University of London, published a new attack that can recover [...]
21.4 Sweet32 SWEET32 [30] is a generic attack against block ciphers with a block size of 64 bits in CBC mode, such as DES or 3DES. However, it has special [...]
21.5.5 TIME Less than a year after CRIME was published, security researchers Tal Be’ery and Amichai Shulman presented a new attack they called Timing Info-leak Made Easy (TIME) [17]. Conceptually, [...]
21.5.6 BREACH In the second half of 2013, security researchers Yoel Gluck, Neal Harris, and Angelo Prado published a modification of CRIME that they called Browser Reconnaissance and Exfiltration via [...]
21.5.7 HEIST In 2016, Mathy Vanhoef and Tom Van Goethem, two security researchers from Belgium, published yet another attack on TLS that exploits the compression side channel. They called their [...]
22.4 Heartbleed In 2014, Google’s security team member Neel Mehta privately reported an implementation bug to OpenSSL’s developer team. The same bug was independently discovered by security engineers working for [...]
22.4.2 The Heartbleed bug Heartbleed is the result of improper input validation – more precisely, a missing bounds check – in the OpenSSL implementation of the TLS Heartbeat extension. Technically, [...]
22.4.3 The bugfix The bugfix for the Heartbleed bug is shown in Listing 22.3. It is a simple bounds check using the actual TLS record length in the s3-¿rrec data [...]
22.6 Random number generation In Chapter 3 A Secret to Share, we learned that the security of most protocols and mechanisms depends on the generation of random sequences of bits [...]