Re: Security of HTTPS

[Frank Knobbe <frank () knobbe us>]

On Sun, 2004-11-28 at 10:15, Ng Pheng Siong wrote:
> In SSL/TLS, the client certificate request is optional, and its typical
> use, HTTPS, does not require client certificates, so there is no client
> public/private key here that can be used to "transfer encrypted key
> material". 

Right. But even if client certificates are used, these are only used for
authentication (signature check) and not for encryption during
master-key negotiation.

That issue is something I have on my mind ever since Michael Warfields
discussion about this in Focus-IDS. I'd like to remember that issue for
comparisons between SSL VPNs with other type of VPNs (IPSec or SSH) as
these do not have the same ...uhm... weakness. I still think people put
too much stock in SSL VPNs.

Oh well...

Cheers,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part