Skip to content

Comment on OpenSSL in Debian Unstable drops TLS 1.0/1.1 supportparent

Comments

A good TLS 1.1 server implementation implementing all the fixes should be "fine". While a good TLS 1.0 client implementation should prevent the BEAST from working.

Note that all of these could run without problems if both side support the encrypt-then-MAC extension (https://tools.ietf.org/html/rfc7366).

It's a lot of "if" though, hence why we prefer TLS 1.2 which has no problems (so far). But usually when nothing do, it is still better to have something than nothing.

If you want to know more about BEAST: https://www.cryptologie.net/article/413/beast-an-explanation...

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.