Looking Back at 2014 End of 1024 Bit Security In 2014, the SSL industry moved to issuing a minimum security of 2048 bit RSA certificates. Keys smaller than 2048 are no longer al…
PKI Consortium blog
Posts by author Bruce Morton
SSL/TLS
The [POODLE attack on SSL 3.0][1] has now been extended to some implementations of TLS. POODLE for TLS can be tracked through [CVE 2014 8730][2]. POODLE is not a flaw with the c…
Vulnerability
In October 2014, [Google announced POODLE][1], an SSL 3.0 protocol attack. To bring you up to speed, the [SSL/TLS protocol][2] is the most important and popular security protoco…
Is your website secure? One thing to consider is securing your website with [HTTP Strict Transport Security (HSTS)][1]. Implementation of HSTS is an extension of the [Always On …
SSL/TLS
With the announcement of the Heartbleed bug and the resulting need to revoke large numbers of SSL certificates, the topic of certificate revocation has, once again, come to the …
Recent revelations from Edward Snowden about pervasive government surveillance have led to many questions about the safety of communications using the SSL/TLS protocol. Such com…
One of the advantages of having multiple certification authorities (CAs) from which to choose an SSL certificate is that customers have flexibility to choose a CA that meets the…
Google
Netcraft has published an article stating they have found many bogus SSL certificates. In this case, a bogus certificate is self signed (i.e., not issued from a legitimate certi…
SSL/TLS
Previously, we advised that the [SSL industry must move to the SHA 2 hashing algorithm][1] for certificate signatures. We thought it would be helpful to provide the reasoning be…
Code Signing
Looking Back at 2013 Protocol Attacks The year started with a couple of SSL/TLS protocol attacks: [Lucky Thirteen][1] and [RC4 attack][2]. Lucky Thirteen allows the decryption o…
