Saint SKIP-TLS, Who Skipped the Steps

Patron of people who skip steps in the procedure, state machines written in one go, and Java clients that trust too much.

Life

Found by the miTLS team and presented in January 2015 among the SMACK attacks, he took advantage of TLS implementations that did not check the order of messages. The Java client, for instance, accepted a handshake missing precisely the steps that authenticate the server: an impostor could skip them and pass for anyone.

Prayer

O Saint SKIP-TLS, who skips the steps of the handshake, teach our protocols that order is sacred. Amen.

How to celebrate

Celebrated by updating Java and rereading the deploy checklist without skipping a single item.

Skip a step, and you shake hands with a stranger.