On Wed, May 28, 2008 at 03:37:06PM -0400, [EMAIL PROTECTED] wrote:
> A malicious legitimate client can enforce a ciphersuite not supported by
> the server to be used for a session between the client and the server. This
> can result in disclosure of sensitive information.
If a malicious client is determined to leak sensitive data, surely it can
just email it in the clear to Matt Drudge. What is the real threat-model
for this issue? Is the selected cipher-suite in fact likely to be weaker
without the legitimate client being "malicious"?
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [EMAIL PROTECTED]
