2026-02-10 00:37:00 +08:00 · 2014-03-19 15:15:16 +01:00
parent 9d98b07e46
commit 1324660760
1 changed files with 4 additions and 2 deletions
							
							
								
							
							
						
@@ -31,10 +31,12 @@ Long term items:
* Certificate authentication to the main process. Possibly that is just
  wishful thinking. To verify the TLS client certificate verify signature 
  packet one needs instead of the signature, the contents of all the handshake 
  messages, and knowledge of the negotiated TLS version, in addition to being 
  one needs in addition to the signature, the contents of all the handshake 
  messages, and knowledge of the negotiated TLS version, as well as being 
  able to select the server hello random. That could be done sanely only if 
  gnutls provided facilities to set the server hello random, and override the 
  client signature verification at an early stage before data are hashed 
  (to verify that the set random value was present in the handshake).
  However, the complexity required to implement that may in fact reduce
  security rather than increase it.