Join GitHub today
GitHub is home to over 20 million developers working together to host and review code, manage projects, and build software together.
Secure against triple handshake attacks #3
We should defend against new triple handshake attacks on TLS. I would suggest just disabling session resumption; this is easier to test than testing if session resumption validates the server cert in exactly the same way.
We're probably only at least partially vulnerable because we only support PFS ciphersuites. A variant of the attack still works, but only for specific broken DHE groups.