Subject: Re: [TLS] DTLS implementation attack?

From: "Paterson, Kenny" <[email-masked]>
Date: Thu, 5 Jan 2012 16:43:19 +0000

On Tue, Dec 6, 2011 at 5:56 PM, Marsh Ray <marsh at extendedsubset.com<http://extendedsubset.com>> wrote:

> Anyone have more info on this?
> Even just a CVE or 'fixed in' version would be helpful.
> http://www.isoc.org/isoc/conferences/ndss/12/program.shtml#1a
> Plaintext-Recovery Attacks Against Datagram TLS

The OpenSSL version of this attack, to be presented at NDSS 2011, has now been given CVE-2011-4108.

A paper describing the attack can be found at: www.isg.rhul.ac.uk/~kp/dtls.pdf<http://www.isg.rhul.ac.uk/~kp/dtls.pdf>

Cheers,

Kenny Paterson