Re: [TLS] [POSSIBLE SPAM] Re: Collisions (Re: Nico's suggestions - Re: Consensus Call:

[Marsh Ray <[e-mail]>]

On 5/11/2010 3:04 PM, Kemp, David P. wrote:
> If there is a script to FTP a bunch of files, and one of the files
> fails, then either a human or a manifest-understanding application needs
> to notice the error and retry.  FTP itself doesn't have to be as
> persistent about recovery as wget, but something above it needs to be.

> How would FTPS with a cache collision induced failure be different?

I think that's the right question for us to be asking.

One way in which things are different is that this proposal introduces
the caching of long-term data. We have to ensure that a one-time
drive-by attacker cannot use the feature to cause the caching of
something that might adversely affect some unrelated operation in the
future.

We should also be careful to prevent data leaks. There is the potential
that server 'a' could engineer a probing collision to determine if
you've previously connected to server 'b'.

- Marsh