Search the Community
Showing results for tags 'tls'.
Web servers that haven’t disabled TLS 1.0 and TLS 1.1 will be downgraded in https testing results. Qualys advises: TLS 1.0 and TLS 1.1 protocols will be removed from browsers at the beginning of 2020. As there are no fixes or patches that can adequately fix SSL or deprecated TLS, it is critically important that organizations upgrade to a secure alternative as soon as possible. https://blog.qualys.com/ssllabs/2018/11/19/grade-change-for-tls-1-0-and-tls-1-1-protocols?fbclid=IwAR2VBdySrhbtuz28N6c0wb9c3axB7-6nY4ANHhuB3e7wKelQ9_q_szmr944
A vulnerability in RSA encryption affects about 3% of all web servers including leading web sites such as Facebook and PayPal. In 1998 Daniel Bleichenbacher, a Swiss cryptographer, identified a problem with the implementation of RSA PKCS #1 v1.5 and it was never fully fixed. Hanno Böck, Juraj Somorovsky, and Craig Young discovered the flaw, to be known as ROBOT, which stands for Return Of Bleichenbacher’s Oracle Threat. It can be used to exploit servers running older ciphers. Servers that are vulnerable to a DROWN attack, forcing a downgrade to older ciphers, are also vulnerable. The researchers recommend to fully deprecate RSA encryption based key exchanges in TLS (ciphers that start with TLS_RSA). Further information is available from https://eprint.iacr.org/2017/1189.pdf