Sending data before completion of handshake

haskell-tls / hs-tls

TLS/SSL implementation in haskell

Other

404 stars 92 forks source link

Sending data before completion of handshake #355

Closed ocheron closed 9 months ago

ocheron commented 5 years ago

In a TLS13 server, sending data before receiving Finished message should not be allowed by default. While it may be acceptable in some applications like SMTP banner, it gives less security properties (replay), and alters server behavior in case of handshake error.

kazu-yamamoto commented 9 months ago

This is not the current approach. Let's close.