Renegotiating TLS

There has been a great deal of chatter in the news, blogs and IETF TLS working group about a recent man-in-the-middle attack that was discovered against the TLS protocol. ICSA Labs is aware of this information and is evaluating the information to see if it affects our certfified products.  There are a couple documents below that have documented this attack.  We are discussing this issue with our consortium vendors.

Secure Socket Layer - Transport Layer Security (SSL-TLS) technology is an important component of a comprehensive enterprise security strategy. SSL-TLS is a widely used protocol for secure network communications. There are a number of diverse markets that have products using implementations of SSL-TLS. Originally designed as a way to secure browsing of the Web, SSL-TLS implementations are now used in VPNs, Business Transaction Servers, Application Servers, as well as other core business functions. Our goal is to develop a certification testing program that will give buyers of these products the assurance that only a reputable independent third party testing facility like ICSA Labs can provide. That is, a standards based program, with a publicly vetted and posted criteria, against which all products are tested.

Interested in being tested?  Interested in joining the SSL-TLS Product Developers Consortium? SSL developers should contact ICSA Labs Secure Communications Program Manager, Guy Snyder via e-mail or phone at 717.790.8142.