inż Mamoń Napisał(a):
-------------------------------------------------------
>Poduczysz sie o TLS i OSI to
> rozmowa bedzie cit lepsza.
Przeciez napisalem, ze to poziom OSInowej (a moze oslej?) lawki w zawodowce, ktora prezentujesz.
Umiejetnoscia liczenia broadcastow, ktora z trudem zdales na klasowce, tez nikomu nie zaimponujesz.
> Oj chyba daje. Ale co ja ci bede tlumaczyl co to
> takiego hash functions....
You must go deeper - (hint: wektor poczatkowy) - dajesz! moze zrozumiesz swoja ignorancje.
Jak juz odszyfrujesz TrueCrypt teczowymi tablicami to daj znac:)
Edit:
A tu masz dowód swojej znajomosci tamatu (a wlasciwie jej braku), mistrzu ILS i teczowych tablic:
[
www.openssl.org]
I jeszcze wiecej:
"The attack works in such way:
1. A user opens any HTTP website like [
google.com] in Iran (for example)
2. Government-controlled Iranian ISP intercepts HTTP traffic and injects some rogue JS code.
3. Rogue JS code opens https-AJAX-connection to [
gmail.com] and transmits some constant nonsense there (chosen plaintext attack).
4. The key point of TLS 0.x-1.0 vulnerability is deterministic calculation of IV in all sessions except first one. Initialization vector (IV) is computed using (pseudo)random numbers for the first session, and subsequent connections to the same website use new IVs computed with deterministic algorithm from previous IVs, without using random numbers. [
eprint.iacr.org]
It's a specific form of key integrity probably intended to counteract partial MitM. Or at least that way it was thought in 1994 by Netscape.
5. Rogue Iranian ISP intercepts resulting https traffic for [
gmail.com] and by comparing known (chosen) plaintext versus ciphertext, computes initial IV. Here is where the novelty of the research is: popular belief in 2006 was this computation requires 2^1000 operations, in 2011 it turns out that could be handled in 10 minutes [see my remark below].
6. User navigates to [
gmail.com] to read email. Browser chooses new IV different from old one, but Iranian ISP can compute it independently because algorithm is deterministic and previous IV is known to them.
7. By knowing second IV, Iranian ISP is able to decrypt all https traffic of the second session and extract user cookies from it. (Not necessarily in real time.)
8. Now Iranian government is able to read user's email by substituting his cookies on any computer and navigating to [
gmail.com].
You may replace Iranian govt in this story with your neighbour in public WiFi, equipped with enhanced version of FireSheep."
Ergo Paul Shemale'sky jestes ignorantem.
Q.E.D.
Zmieniany 2 raz(y). Ostatnia zmiana 2011-10-14 22:45 przez MarcinS.