
TLS Cryptography In-Depth
By :

In 2009, Marsh Ray and Steve Dispensa, two employees of a company providing a multi-factor authentication solution that was eventually acquired by Microsoft and integrated into Azure, discovered a renegotiation-related vulnerability in then-current TLS versions that allowed Mallory to inject an arbitrary amount of chosen plaintext into the beginning of the application protocol stream [111].
Conceptually, then-current TLS versions were vulnerable to insecure renegotiation because server Alice did not verify whether the source – that is, her communication peer – of the old and the new data in a TLS session was the same.
Using the insecure renegotiation attack, Mallory can inject data that Alice will process as if it came from Bob. For instance, in a web application, Mallory can inject an unauthenticated HTTP request and trick Alice into processing that request in the context of the authenticated user Bob.
Technically, the attack is carried...
Change the font size
Change margin width
Change background colour