Subject: [TLS] Dr-Ing. thesis on attacking SSL

From: Watson Ladd <[email-masked]>
Date: Wed, 16 Apr 2014 22:41:55 -0700

Dear all,

I would highly suggest reading the following.
http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/MeyerChristopher/diss.pdf
Some of these attacks are new, some are old. A patch has been released
to Java for some of these issues, but other implementations should go
through and check.

Of particular interest is the advanced fingerprinting capability
displayed, due to variant behavior between crypto stacks. In addition
weakness in random number generation go beyond Dual_EC. Furthermore,
the Million Message Attack continues to be useful. From my brief
glance through it looks like this is about it.

Sincerely,
Watson Ladd