Security - TLS Status - Revision history

Thomas Glennon at 13:59, 6 July 2015

2015-07-06T13:59:42Z

Thomas Glennon at 13:58, 6 July 2015

2015-07-06T13:58:57Z

Thomas Glennon at 13:58, 6 July 2015

2015-07-06T13:58:42Z

Thomas Glennon at 13:58, 6 July 2015

2015-07-06T13:58:25Z

Thomas Glennon at 13:57, 6 July 2015

2015-07-06T13:57:57Z

Thomas Glennon at 13:57, 6 July 2015

2015-07-06T13:57:42Z

Thomas Glennon at 13:56, 6 July 2015

2015-07-06T13:56:40Z

Thomas Glennon at 13:56, 6 July 2015

2015-07-06T13:56:01Z

Thomas Glennon at 13:55, 6 July 2015

2015-07-06T13:55:37Z

Thomas Glennon: Created page with "As of 04/07/2015 - Bxp Software can use TLS 1.0 up to TLS 1.2. Bxp software is a secure software solution utilising various methods of encryption and authentication when pos..."

2015-07-06T13:55:16Z

Created page with "As of 04/07/2015 - Bxp Software can use TLS 1.0 up to TLS 1.2. Bxp software is a secure software solution utilising various methods of encryption and authentication when pos..."

New page

As of 04/07/2015 - Bxp Software can use TLS 1.0 up to TLS 1.2.

Bxp software is a secure software solution utilising various methods of encryption and authentication when possible. The latest change in bxp’s security was the upgrading of our cryptographic protocol for our web service.
In the past TLS 1.0 was used by all of our clients as it was back compatible with all of our clients systems. The most recent change to our cryptographic protocol was to implement TLS negotiation on our web service. With this in place our clients using legacy software can still use the service through TLS 1.0 while clients with modern browsers will be able to utilise a more secure TLS 1.2 connection.

Improvements from this upgrade include:
TLS 1.2 [..] Based on TLS 1.1, TLS 1.2 contains improved flexibility. The major differences include:
• The MD5/SHA-1 combination in the pseudorandom function (PRF) was replaced with cipher-suite-specified PRFs.
• The MD5/SHA-1 combination in the digitally-signed element was replaced with a single hash. Signed elements include a field explicitly specifying the hash algorithm used.
• There was substantial clean-up to the client's and server's ability to specify which hash and signature algorithms they will accept.
• Addition of support for authenticated encryption with additional data modes.
• TLS Extensions definition and AES Cipher Suites were merged in.
• Tighter checking of EncryptedPreMasterSecret version numbers.
• Many of the requirements were tightened
• Verify_data length depends on the cipher suite
• Description of Bleichenbacher/Dlima attack defenses cleaned up.

← Older revision		Revision as of 13:59, 6 July 2015
Line 1:		Line 1:

−	== ~~As of~~ 04/07/2015 - Bxp Software ~~can use TLS 1.0 up to~~ TLS 1.2. ==	+	== 04/07/2015 - Bxp Software now supports TLS 1.2. ==

← Older revision		Revision as of 13:58, 6 July 2015
Line 1:		Line 1:
−	As of 04/07/2015 - Bxp Software can use TLS 1.0 up to TLS 1.2.	+
		+	== As of 04/07/2015 - Bxp Software can use TLS 1.0 up to TLS 1.2. ==
		+

@@ Line 5: / Line 5: @@
 In the past TLS 1.0 was used by all of our clients as it was back compatible with all of our clients systems. The most recent change to our cryptographic protocol was to implement TLS negotiation on our web service. With this in place our clients using legacy software can still use the service through TLS 1.0 while clients with modern browsers will be able to utilise a more secure TLS 1.2 connection.<br>
-Improvements from this upgrade include:<br>
 TLS 1.2 [..] Based on TLS 1.1, TLS 1.2 contains improved flexibility. The major differences include:<br>
 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;•	The MD5/SHA-1 combination in the pseudorandom function (PRF) was replaced with cipher-suite-specified PRFs.<br>

@@ Line 7: / Line 7: @@
 Improvements from this upgrade include:<br>
 TLS 1.2 [..] Based on TLS 1.1, TLS 1.2 contains improved flexibility. The major differences include:<br>
-&nbsp;•	The MD5/SHA-1 combination in the pseudorandom function (PRF) was replaced with cipher-suite-specified PRFs.<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;•	The MD5/SHA-1 combination in the pseudorandom function (PRF) was replaced with cipher-suite-specified PRFs.<br>
-•	The MD5/SHA-1 combination in the digitally-signed element was replaced with a single hash. Signed elements include a field explicitly specifying the hash algorithm used.<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;•	The MD5/SHA-1 combination in the digitally-signed element was replaced with a single hash. Signed elements include a field explicitly specifying the hash algorithm used.<br>
-•	There was substantial clean-up to the client's and server's ability to specify which hash and signature algorithms they will accept.<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;•	There was substantial clean-up to the client's and server's ability to specify which hash and signature algorithms they will accept.<br>
-•	Addition of support for authenticated encryption with additional data modes.<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;•	Addition of support for authenticated encryption with additional data modes.<br>
-•	TLS Extensions definition and AES Cipher Suites were merged in.<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;•	TLS Extensions definition and AES Cipher Suites were merged in.<br>
-•	Tighter checking of EncryptedPreMasterSecret version numbers.<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;•	Tighter checking of EncryptedPreMasterSecret version numbers.<br>
-•	Many of the requirements were tightened<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;•	Many of the requirements were tightened<br>
-•	Verify_data length depends on the cipher suite<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;•	Verify_data length depends on the cipher suite<br>
-•	Description of Bleichenbacher/Dlima attack defenses cleaned up.<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;•	Description of Bleichenbacher/Dlima attack defenses cleaned up.<br>

@@ Line 7: / Line 7: @@
 Improvements from this upgrade include:<br>
 TLS 1.2 [..] Based on TLS 1.1, TLS 1.2 contains improved flexibility. The major differences include:<br>
-&npsp;•	The MD5/SHA-1 combination in the pseudorandom function (PRF) was replaced with cipher-suite-specified PRFs.<br>
+&nbsp;•	The MD5/SHA-1 combination in the pseudorandom function (PRF) was replaced with cipher-suite-specified PRFs.<br>
 •	The MD5/SHA-1 combination in the digitally-signed element was replaced with a single hash. Signed elements include a field explicitly specifying the hash algorithm used.<br>
 •	There was substantial clean-up to the client's and server's ability to specify which hash and signature algorithms they will accept.<br>