In regards to the protections implemented in OpenSSL 0.9.6d (described in section 2. http://www.openssl.org/~bodo/tls-cbc.txt). My understanding is that the mechanism prepends an empty record when sending data in order to make the IV unpredictable. however the client->server and server->client maintain separate IV data.

If relying on this mechanism to protect against CBC vulnerabilities (such as BEAST) is it required that both client and server have this mechanism enabled?

  • 1
    $\begingroup$ During the BEAST excitement in 2011, it was discovered that some broken SSL implementations cannot handle empty records, so modern implementations no longer use that mitigaton. Instead, they use "1/n-1 record splitting", where they first send a one-byte record, and then a second record with the rest of the data. (Some broken implementations were incompatible with this, too, but you can't have everything.) $\endgroup$ – Matt Nordhoff Feb 6 '14 at 1:42

Yes, both the client and the server must have this mechanism enabled to get full protection from BEAST and similar attacks.

In particular, if the client is a browser with scripting capabilities, it is the client side implementation that must send empty packets before each content packet. Enabling this feature server side only, just means that the server will send such empty packets. This will provide no protection from script based attacks against browsers.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.