Researchers: Hole In TLS Encryption Could Expose Secure Web Sessions

Researchers at Royal Holloway, University of London disclosed a flaw in the TLS specification that can be exploited with timing-based attacks to recover complete blocks of TLS-encrypted plaintext. The paper describes proof-of-concept attacks that rely on detecting small differences in decryption timing and may require a very large number of TLS sessions or local network access, though more efficient variants can be possible in specific conditions.