IETF Logo Mail Archive

Re: [TLS] Rizzo claims implementation attach, should be interesting

"Steingruebl, Andy" <asteingruebl@paypal-inc.com> Mon, 19 September 2011 23:39 UTC

Return-Path: <asteingruebl@paypal-inc.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77BCE21F8B3E for <tls@ietfa.amsl.com>; Mon, 19 Sep 2011 16:39:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.117
X-Spam-Level:
X-Spam-Status: No, score=-9.117 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, DNS_FROM_RFC_BOGUSMX=1.482, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MIDxy2nf6IQJ for <tls@ietfa.amsl.com>; Mon, 19 Sep 2011 16:39:54 -0700 (PDT)
Received: from den-mipot-002.corp.ebay.com (den-mipot-002.corp.ebay.com [216.113.175.153]) by ietfa.amsl.com (Postfix) with ESMTP id 9CEEC21F8B3D for <tls@ietf.org>; Mon, 19 Sep 2011 16:39:54 -0700 (PDT)
DomainKey-Signature: s=ppinc; d=paypal-inc.com; c=nofws; q=dns; h=X-EBay-Corp:X-IronPort-AV:Received:Received:From:To:Date: Subject:Thread-Topic:Thread-Index:Message-ID:References: In-Reply-To:Accept-Language:Content-Language: X-MS-Has-Attach:X-MS-TNEF-Correlator:acceptlanguage: x-ems-proccessed:x-ems-stamp:Content-Type: Content-Transfer-Encoding:MIME-Version:X-CFilter; b=c+h5YT4Ybj0vscao2qPRyWrEHMe1pVeR8I0ZIxwRIWx+ikIXuvDcpiGt 642PGVSNlloqtp5snUFsmF09UiieXTgOKQ5agaEOycB5j4cE6vxp6drxz FTFLJlugGPI/O5q;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paypal-inc.com; i=asteingruebl@paypal-inc.com; q=dns/txt; s=ppinc; t=1316475739; x=1348011739; h=from:to:date:subject:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=cEQW8STiZ8ktsAn3FthXwgskqcueWdpPn+shpS2unH0=; b=EQ+jEkREwQif+omCawp486kzcF1kHgsdAaSCsU2x/sIjCfeg/BlXk3Pv CIxgtFI5k1hi6oGeR7/pnj281Fsv+8ACqPGeapeXN5THdLstMGEP6Lp6p 08hyFdUhDvZdET8;
X-EBay-Corp: Yes
X-IronPort-AV: E=Sophos;i="4.68,408,1312182000"; d="scan'208";a="3950543"
Received: from den-vtenf-001.corp.ebay.com (HELO DEN-MEXHT-002.corp.ebay.com) ([10.101.112.212]) by den-mipot-002.corp.ebay.com with ESMTP; 19 Sep 2011 16:42:19 -0700
Received: from DEN-MEXMS-001.corp.ebay.com ([10.241.16.225]) by DEN-MEXHT-002.corp.ebay.com ([10.241.17.53]) with mapi; Mon, 19 Sep 2011 17:42:18 -0600
From: "Steingruebl, Andy" <asteingruebl@paypal-inc.com>
To: "mrex@sap.com" <mrex@sap.com>, "tls@ietf.org" <tls@ietf.org>
Date: Mon, 19 Sep 2011 17:42:17 -0600
Thread-Topic: [TLS] Rizzo claims implementation attach, should be interesting
Thread-Index: Acx2/iAnZ0mAF63YREKubJMpnC1LRQAJ2evQ
Message-ID: <5EE049BA3C6538409BBE6F1760F328ABEBD61B6ACA@DEN-MEXMS-001.corp.ebay.com>
References: <CALpzJPqJ3WCPZ-542om9D2uRNmQ97kxWTJDvJHResjsRdiK-Eg@mail.gmail.com> from "Tim Dierks" at Sep 10, 11 12:41:11 pm <201109191857.p8JIvik9021961@fs4113.wdf.sap.corp>
In-Reply-To: <201109191857.p8JIvik9021961@fs4113.wdf.sap.corp>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
x-ems-proccessed: 10SqDH0iR7ekR7SRpKqm5A==
x-ems-stamp: tUJxIlQEikrrPavCDqYPNg==
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-CFilter: Scanned
Subject: Re: [TLS] Rizzo claims implementation attach, should be interesting
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 19 Sep 2011 23:39:55 -0000

> -----Original Message-----
> From: tls-bounces@ietf.org [mailto:tls-bounces@ietf.org] On Behalf Of
> Martin Rex
> 
> Tim Dierks wrote:
> >
> > Does anyone have any ideas what Rizzo may be announcing @ ekoparty?
> >
> > http://www.ekoparty.org/2011/juliano-rizzo.php
> >
> > BEAST: Surprising crypto attack against HTTPS
> 
> The first details seem to be leaking:
> 
> http://threatpost.com/en_us/blogs/new-attack-breaks-confidentiality-
> model-ssl-allows-theft-encrypted-cookies-091611

More "details" here:

http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/

Or at least more confirming quotes from the researchers about how quickly the can perform the attack.

v2.23.0 | Report a Bug | By Email