Saint CCS Injection, Who Changed Ciphers Too Soon

Patron of TLS handshakes, messages that arrive out of turn, and bugs as old as the project itself.

Life

On 5 June 2014, two months after Heartbleed, OpenSSL disclosed another flaw, found by Masashi Kikuchi of Lepidum. An attacker in the middle could slip in a ChangeCipherSpec message ahead of time, and OpenSSL accepted it, ending up encrypting with weak, predictable keys. Both client and server had to be vulnerable, but then the traffic could be read and altered. According to its discoverer, the bug had been there since the earliest releases.

Prayer

O Saint CCS Injection, who speaks before it is your turn, teach our handshakes to wait for theirs. Amen.

How to celebrate

Celebrated by upgrading OpenSSL to 0.9.8za, 1.0.0m or 1.0.1h, and waiting your turn in the queue at the post office.

Change your cipher before your turn, and your secrets are the neighbour's to learn.