Re: [TLS] TLS document status update

[Eric Rescorla <ekr@xxxxxxxxxxxxxxxxxxxx>]

At Tue, 29 Apr 2008 13:42:05 -0700,
Mike wrote:
> 
> >> But how could the substitution attack even succeed?  You would need
> >> to create a valid CA signature on the replacement certificate, which
> >> should not be possible.
> > 
> > Why not? All you need is a CA which doesn't require technical
> > Proof of Possession of the private key.
> 
> If you can't trust your own CA, then by all means send the hash.

This is not about trusting your own CA, because a CA which issues
certificates without requiring PoP is not acting in an untrustworthy
fashion.

To recap, the attack looks like this:

1. Alice gets a certificate with key pair K_pub, K_priv.
2. The attacker gets his own certificate with K_pub, K_priv
   under his own name.
3. Alice connects to the server and offers to authenticate
   using certificate_url.
4. The attacker intercepts the server's connection to the
   URL provided by Alice and substitutes his own certificate.
5. The server now thinks that any data sent by Alice was
   actually sent by the attacker.

So, first of all, whatever CA the attacker used has not done
anything wrong. Second, the CA can be totally different from
the client. Third, the client has no way of knowing what
policies the CAs trusted by the server enforce.

-Ekr










_______________________________________________
TLS mailing list
TLS@xxxxxxxx
https://www.ietf.org/mailman/listinfo/tls