SECURITY RESEARCH / ENGINEERING
文章与研究
在证据与实验中理解复杂系统。
2012-09-11
白皮书下载地址：http://kuai.xunlei.com/d/BDNAUXCHLSOO
解压密码:www.mythhack.com
package peast;
import java.util.Arrays;
//"POST /"(6) + prefix + " HTTP/1.1\r\n"(11)
public class Decryptor {
private String plaintext = "";
private String prefixRight = "";
private static final String prefixLeft = "POST /";
private byte[] ciphertext;
private int blockSize;
private byte[] target;
private byte[] targetIV;
private byte attemptLastByte = 0x20;
private byte[] nextAttempt;
public Decryptor() {
}
public void setCiphertext(byte[] ciphertext) {
// TODO get blocksize from packets
blockSize = 16;
assert (ciphertext.length % blockSize == 0);
this.ciphertext......
阅读全文 →
2012-09-11
白皮书下载地址：http://kuai.xunlei.com/d/BDNAUXCHLSOO
解压密码:www.mythhack.com
package peast;
import java.util.Arrays;
//"POST /"(6) + prefix + " HTTP/1.1\r\n"(11)
public class Decryptor {
private String plaintext = "";
private String prefixRight = "";
private static final String prefixLeft = "POST /";
private byte[] ciphertext;
private int blockSize;
private byte[] target;
private byte[] targetIV;
private byte attemptLastByte = 0x20;
private byte[] nextAttempt;
public Decryptor() {
}
public void setCiphertext(byte[] ciphertext) {
// TODO get blocksize from packets
blockSize = 16;
assert (ciphertext.length % blockSize == 0);
this.ciphertext......
阅读全文 →
2012-09-11
翻译的很烂大家凑合看。英文好的童鞋可以去http://luxsci.com/blog/is-ssltls-really-broken-by-the-beast-attack-what-is-the-real-story-what-should-i-do.html
OpenSSL 1.0.1版，它支持TLS v1.1和v1.2，这有助于减少这种攻击。现在所有网站应该使用更新的openssl更安全。 建议使用一个支持TLS v1.1和v1.2的ssl
SSLv3和TLS V1存在一个严重的漏洞，根据最近发......
阅读全文 →