Subject: [Nea] Fwd: [TLS] MITM Attacks on Client Authentication after Resumption

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Tue, 4 Mar 2014 11:06:39 +0000

The link below details a vulnerability involving session resumption and TLS channel bindings that is applicable to PT-TLS.  There is ongoing discussion on the TLS and Kitten lists.

 https://secure-resumption.com<https://secure-resumption.com/>

Basically if the TLS connection is torn down and resumed before channel binding within the EMA takes place a man-in-the-middle will not be discovered.

Joe