TLS specifications: Difference between revisions
From FileZilla Wiki
Jump to navigationJump to search
(Change external links to HTTPS) |
No edit summary |
||
Line 1: | Line 1: | ||
The ''Transport Layer Security'' (TLS) protocol gets used to cryptographically protect a socket connection. It is the successor of the ''Secure Sockets Layer'' (SSL) protocol. TLS gets used for the FTP over TLS/SSL (FTPS) protocol. | The ''Transport Layer Security'' (TLS) protocol gets used to cryptographically protect a socket connection. It is the successor of the ''Secure Sockets Layer'' (SSL) protocol. TLS gets used for the FTP over TLS/SSL (FTPS) protocol. | ||
* [https://filezilla-project.org/specs/rfc7465.txt <nowiki>RFC 7465</nowiki>] "Prohibiting RC4 Cipher Suites" | * [https://filezilla-project.org/specs/rfc7465.txt <nowiki>RFC 7465</nowiki>] "Prohibiting RC4 Cipher Suites" | ||
Revision as of 01:34, 2 December 2017
The Transport Layer Security (TLS) protocol gets used to cryptographically protect a socket connection. It is the successor of the Secure Sockets Layer (SSL) protocol. TLS gets used for the FTP over TLS/SSL (FTPS) protocol.
- RFC 7465 "Prohibiting RC4 Cipher Suites"
Points of interest
- Section 7.2.1. of RFC 2246: Closure alerts
The client and the server must share knowledge that the connection is ending in order to avoid a truncation attack. Either party may initiate the exchange of closing messages. [...] Each party is required to send a close_notify alert before closing the write side of the connection.
- Lots of FTP servers did not follow the specifications and were vulnerable to truncation attacks. FileZilla will properly fail transfers on those servers.