This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I used wireshark to capture a SSL handshake and when I inspected the Client Hello packet and went to the Cipher Suites heading and I saw the following cipher:

Cipher Suite: TLS EMPTY RENEGOTIATION INFO SCSV (0x00ff)

(There should be an underscore where those spaces are)

I only see that when I inspect a SSL handshake if FireFox initiates the handshake, but if I used Chrome or Internet Explorer I don't see that. Why is that? I did google the cipher suite, but I didn't understand most of it. From what I could understand it was added with FireFox 8 and it has something to do with java.

asked 20 Oct '12, 09:56

Howlin1's gravatar image

Howlin1
6113
accept rate: 0%


This message is part of the TLS Secure Renegotiation protocol which was introduced to defeat a vulnerability in the original TLS session renegotiation protocol discovered 2009 and only fully handled by most server and client TLS implementations this year. The state of the TLS renegotiation process used by a particular client will depend in part on the underlying cryptographic provider (the latest Java and OpenSSL versions support the new process) and the options which have been set by the application which requests the cryptographic operation.

TLS clients which do not support the new secure renegotiation protocol will be refused by any properly patched TLS server if they submit an original style TLS renegotation request. (The most common use, AFAIK, of TLS renegotiation has been to allow an HTTPS server to request client certificate authentication after the original TLS handshake has been completed. This is used, for example, when the server considers some URL paths to require stronger client authentication than others, but cannot make that determination until after the initial HTTPS Request has been examined.

permanent link

answered 23 Oct '12, 01:46

inetdog's gravatar image

inetdog
16717
accept rate: 14%

edited 24 Oct '12, 11:16

Ah okay, thanks :)

(24 Oct '12, 08:33) Howlin1
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×319
×44
×6

question asked: 20 Oct '12, 09:56

question was seen: 10,615 times

last updated: 24 Oct '12, 11:16

p​o​w​e​r​e​d by O​S​Q​A