Frank Breedijk, a security professional at a provider of mission critical outsourcing services called Schuberg Philis, based in the Netherlands, says that Rescorla's draft does fix the protocol, but notes that it effectively creates two versions of TLS. If either the client or the server haven't yet installed the fix, he says, the attack is still possible. "TLS/SSL clients and servers are omnipresent," he says. "It's not just browsers and Web servers. Mobile phones, wireless access points, DECT phones, home security systems, and so on, all have the technology in them." "If you believe that you need SSL at all, then you need this fixed," says Ben Laurie, a founding director of the Apache Software Foundation and an OpenSSL developer. That may be easier said than done, however. Ray and Dispensa disclosed the flaw to affected vendors in late September, and Laurie says it's been "no big deal" to write software that fixes it. What's tricky, he says, is getting the patch installed everywhere it needs to be. The fix is "unprecedented," Laurie says, because no one is fully protected until both the client and the server have installed the patch. As a result, browser makers working to fix the problem have to allow for a period when the client will continue to communicate with unpatched and possibly vulnerable servers. "You can't have the clients say, 'Evil old server, can't connect to that,' because that would break the whole world," Laurie says. This means that a second patch will have to be applied to clients later, when experts determine that enough servers have been patched. The process of getting out all the patches is complex enough that Joe Salowey, TLS working group cochair and a technical leader at Cisco Systems, believes it will be a year or more before the fix will be fully in place. |
E-mail
Audio »
Print
Favorite
Share »
Digg this
Add to del.icio.us
Add to Reddit
Add to Facebook
Slashdot It!
Stumble It!
Add to Newsvine
Add to Connotea
Add to CiteUlike
Add to Furl
Googlize this
Add to Rojo
Add to MyWeb
Computing with Secrets, but Keeping them Safe
06/11/2010
Massachusetts Institute of Technology
Tags
encryption Internet protocols Internet Security patches SSL