Question

Consider the following statement:

The secure socket layer (SSL) protocol allows for secure communication

between a client and a server.

There are known flaws in the SSLv2 protocol. A man-in-the-middle attacker can

force the communication to a less secure level and then attempt break the

encryption. The attacker can also truncate encrypted messages.

These flaws have been fixed in SSLv3 (TLSv1). Most servers and clients support

both SSLv2 and SSLv3. However, SSLv2 is enabled by default for backward

compatibility.

Answer the following questions,

a) Find out the impact in the above statement.

b) What is the solution?

c) Do you think SSLv3 is more secure? Justify your answer.

Answer 1

a)

Solution:

• The given statements state that secure communication is required between the client and the server.
• The protocol SSLv3 is now being used between the client and the server for the communication that makes the communication more secure.
• And the attack, man in the middle is not possible in SSLv3 which may possible in SSLv2.

b)

Solution:

• In order to make the communication between the client and the server more secure, the better solution is to implementation SSLv3 rather than SSLv2.

c)

Solution:

• Yes, as per thinking, among SSLv3 and SSLv2 the more secure is SSLv3.
• Since the data is being sent in an encrypted way so it is much more secure from the attacks.