diff options
author | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2003-08-11 18:29:49 +0000 |
---|---|---|
committer | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2003-08-11 18:29:49 +0000 |
commit | f8c5c05a58933e12843b7e4145b0ed6d565345c2 (patch) | |
tree | 262afef6775c4d1e7ec81d0636fc5594caef7e31 /doc | |
parent | 5201ca6996cd2085292f15c67f4f53ec805a1b3e (diff) | |
download | gnutls-f8c5c05a58933e12843b7e4145b0ed6d565345c2.tar.gz |
still more patches by Arne Thomassen
Diffstat (limited to 'doc')
-rw-r--r-- | doc/tex/alert.tex | 6 | ||||
-rw-r--r-- | doc/tex/ciphersuites.tex | 4 | ||||
-rw-r--r-- | doc/tex/ex-cert-select.tex | 2 | ||||
-rw-r--r-- | doc/tex/howto.tex | 2 | ||||
-rw-r--r-- | doc/tex/record.tex | 2 | ||||
-rw-r--r-- | doc/tex/record_weaknesses.tex | 6 | ||||
-rw-r--r-- | doc/tex/srp.tex | 4 | ||||
-rw-r--r-- | doc/tex/translayer.tex | 16 |
8 files changed, 19 insertions, 23 deletions
diff --git a/doc/tex/alert.tex b/doc/tex/alert.tex index 74c6740de7..3c1f13df27 100644 --- a/doc/tex/alert.tex +++ b/doc/tex/alert.tex @@ -13,8 +13,8 @@ fatal or warning. Fatal alerts always terminate the current connection, and prevent future renegotiations using the current session ID. \par The alert messages are protected by the record protocol, thus -the information that it's included does not leak. You must take -extreme care for the alert information not to leak, to a possible attacker +the information that is included does not leak. You must take +extreme care for the alert information not to leak to a possible attacker (via public log files etc). \par @@ -28,5 +28,3 @@ returns the last received alert. \item \printfunc{gnutls_alert_get_name}{gnutls\_alert\_get\_name}: returns the name (in a character array) of the given alert. \end{itemize} - - diff --git a/doc/tex/ciphersuites.tex b/doc/tex/ciphersuites.tex index 29031304ad..65dda77442 100644 --- a/doc/tex/ciphersuites.tex +++ b/doc/tex/ciphersuites.tex @@ -13,12 +13,10 @@ be described as a keyed hash algorithm. See RFC2104.} algorithm used for authent MAC\_SHA is used in the above example. \end{itemize} -The cipher suite negotiated in the handshake protocol, will affect +The cipher suite negotiated in the handshake protocol will affect the Record Protocol, by enabling encryption and data authentication. Note that you should not over rely on \tls{} to negotiate the strongest available cipher suite. Do not enable ciphers and algorithms that you consider weak. \addvspace{1.5cm} - - diff --git a/doc/tex/ex-cert-select.tex b/doc/tex/ex-cert-select.tex index 0c8fe78ab8..a24ab350ad 100644 --- a/doc/tex/ex-cert-select.tex +++ b/doc/tex/ex-cert-select.tex @@ -34,7 +34,7 @@ static int cert_callback(gnutls_session session, } } - /* Select a certificate from the client_certs and return it's + /* Select a certificate from the client_certs and return its * index. */ diff --git a/doc/tex/howto.tex b/doc/tex/howto.tex index 6621a2a59f..73d8d4e2e5 100644 --- a/doc/tex/howto.tex +++ b/doc/tex/howto.tex @@ -18,7 +18,7 @@ with this method is a denial of service one. The most famous example of this method is the famous ``HTTP over TLS'' or HTTPS\footnote{RFC2818} protocol. \par -Despite it's wide use, this method is not as good as it seems. +Despite its wide use, this method is not as good as it seems. This approach starts the \tls{} Handshake procedure just after the client connects on the --so called-- secure port. That way the \tls{} protocol does not know anything diff --git a/doc/tex/record.tex b/doc/tex/record.tex index 32ebf036b4..19defc52e9 100644 --- a/doc/tex/record.tex +++ b/doc/tex/record.tex @@ -1,6 +1,6 @@ \section{The TLS record protocol\index{TLS protocols!Record}} -The Record protocol is the secure communications provider. It's purpose +The Record protocol is the secure communications provider. Its purpose is to encrypt, authenticate and --optionally-- compress packets. The following functions are available: \par diff --git a/doc/tex/record_weaknesses.tex b/doc/tex/record_weaknesses.tex index e2a3280d18..75c5696a11 100644 --- a/doc/tex/record_weaknesses.tex +++ b/doc/tex/record_weaknesses.tex @@ -3,10 +3,10 @@ Some weaknesses that may affect the security of the Record layer have been found in \tlsI{} protocol. These weaknesses can be exploited by active attackers, -and exploit the facts that \tls{} +and exploit the facts that \begin{enumerate} -\item has separate alerts for ``decryption\_failed'' and ``bad\_record\_mac'' -\item the decryption failure reason can be detected by timing the responce time +\item \tls{} has separate alerts for ``decryption\_failed'' and ``bad\_record\_mac'' +\item the decryption failure reason can be detected by timing the response time \item the IV for CBC encrypted packets is the last block of the previous encrypted packet \end{enumerate} diff --git a/doc/tex/srp.tex b/doc/tex/srp.tex index 5499267c59..a71e7643cf 100644 --- a/doc/tex/srp.tex +++ b/doc/tex/srp.tex @@ -1,8 +1,8 @@ \section{Authentication using SRP\index{SRP authentication}} -Authentication using the SRP\footnote{SRP stands for Secure Password Protocol and +Authentication using the SRP\footnote{SRP stands for Secure Remote Password and is described in \cite{RFC2945}. The SRP key exchange is not a part of the \tlsI{} protocol} -is actually password authentication, since the two peers are identified by the knowledge of a password. +protocol is actually password authentication, since the two peers are identified by the knowledge of a password. This protocol also offers protection against off-line attacks, such as password file stealing. This is achieved since SRP does not use the plain password to perform authentication, diff --git a/doc/tex/translayer.tex b/doc/tex/translayer.tex index 0348626a15..8ab54a3b44 100644 --- a/doc/tex/translayer.tex +++ b/doc/tex/translayer.tex @@ -1,9 +1,9 @@ \section{The transport layer} \par -\tls{} is not limited to any transport layer, it -can be used above any transport layer, as long as, it is a reliable -one. A set of functions is provided and its purpose is to load -to gnutls the required callbacks to access the transport layer. +\tls{} is not limited to one transport layer, it +can be used above any transport layer, as long as it is a reliable +one. A set of functions is provided and their purpose is to load +to \gnutls{} the required callbacks to access the transport layer. \begin{itemize} \item \printfunc{gnutls_transport_set_push_function}{gnutls\_transport\_set\_push\_function} @@ -16,16 +16,16 @@ The callback functions should return the number of bytes written, or -1 on error and should set errno appropriately. \par \gnutls{} currently only interprets the EINTR and EAGAIN errno values and -returns the corresponding gnutls error codes GNUTLS\_E\_INTERRUPTED and +returns the corresponding \gnutls{} error codes GNUTLS\_E\_INTERRUPTED and GNUTLS\_E\_AGAIN. These values are usually returned by interrupted system calls, or when non blocking IO is used. All \gnutls{} functions can be resumed (called again), if any of these error codes is returned. The error codes above refer to the system call, not the \gnutls{} function, -since signals do not interrupt gnutls' functions. +since signals do not interrupt \gnutls{}' functions. \par By default, if the transport functions are not set, \gnutls{} will use the Berkeley Sockets functions. In this case -gnutls will use some hacks in order for \emph{select()} to work, thus -making easy to add \tls{} support to existing TCP/IP servers. +\gnutls{} will use some hacks in order for \emph{select()} to work, thus +making it easy to add \tls{} support to existing TCP/IP servers. |