Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

In regards to the protections implemented in OpenSSL 0.9.6d (described in section 2. http://www.openssl.org/~bodo/tls-cbc.txt). My understanding is that the mechanism prepends an empty record when sending data in order to make the IV unpredictable. however the client->server and server->client maintain separate IV data.

If relying on this mechanism to protect against CBC vulnerabilities (such as BEAST) is it required that both client and server have this mechanism enabled?

share|improve this question
1  
During the BEAST excitement in 2011, it was discovered that some broken SSL implementations cannot handle empty records, so modern implementations no longer use that mitigaton. Instead, they use "1/n-1 record splitting", where they first send a one-byte record, and then a second record with the rest of the data. (Some broken implementations were incompatible with this, too, but you can't have everything.) –  Matt Nordhoff Feb 6 at 1:42

1 Answer 1

up vote 1 down vote accepted

Yes, both the client and the server must have this mechanism enabled to get full protection from BEAST and similar attacks.

In particular, if the client is a browser with scripting capabilities, it is the client side implementation that must send empty packets before each content packet. Enabling this feature server side only, just means that the server will send such empty packets. This will provide no protection from script based attacks against browsers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.