Tag: tls

The POODLE attack, a chosen-plaintext attack, exposes vulnerabilities in SSLv3 block ciphers, compromising encrypted session data. This highlights the need to transition to TLS. Additionally, the SSL/TLS version selection fallback mechanism poses risks of protocol downgrades, but TLS Signaling Cipher Suite Value (SCSV) provides a solution to prevent such attacks.

The recent Comodo sub-CA bogus certificate issuance has sparked a loud discussion in the security community. This incident highlights the flaws in the SSL certificate authority (CA) model. Trusting numerous CAs globally creates vulnerability, and compromised registration authorities (RAs) can issue certificates for any domain. Incident response and transparency are crucial, but incidents like this…