Re: [TLS] Rizzo claims implementation attach, should be interesting

[Eric Rescorla <[e-mail]>]

On Tue, Sep 20, 2011 at 8:21 AM, Martin Rex <[e-mail]> wrote:
> Marsh Ray wrote:
>>
>> I've not been told the details of Duong and Rizzo's attack and haven't
>> seen "the BEAST" in action yet, so I'm not sure if that would be
>> sufficient to fix CBC in TLS 1.0. I am slightly annoyed at these guys
>> for dribbling out the information one hint at a time like this.
>
> The "ekoparty conference" is 21-23 Sep., and usually if you get a
> paper accepted for a conference, you're not supposed to publish
> before the conference...

For what it's worth, that's not the convention in most academic security
conferences I've been involved with (e.g., USENIX Security, ISOC NDSS,
IEEE Oakland). Indeed, it's common to see papers submitted (i.e.,
not even accepted!) that have already been distributed on the author's
web sites. I don't know what the rules for ekoparty are, however.

-Ekr