Re: Truly scary SSL 3.0 vuln to be revealed soon:

[Hanno Böck <hanno () hboeck de>]

Am Wed, 15 Oct 2014 11:13:37 +0200
schrieb Pierre Schweitzer <pierre () reactos org>:

> It says you can recover plain text of ciphered text, using a specific
> method.
> But, in the end it means you'll have plain text + ciphered text of the
> same text. Does that mean you can easily bruteforce the key that was
> used? So that you can actually, if you logged the complete session,
> decipher the whole session of the user? And not only the cookie?

No.
If you could brute force the key then this would indicate a completely
broken ciphersuite.
We're usually talking about AES or 3DES here. These are considered
reasonably safe.

You only get the cookie. The reason this matters is that cookies often
contain a secure token that is used to indicate the session. So you can
takeover a session e.g. for a mailaccount.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno () hboeck de
GPG: BBB51E42

Attachment: signature.asc
Description: