Re: [TLS] TLS document status update

[Eric Rescorla <ekr@xxxxxxxxxxxxxxxxxxxx>]

At Tue, 29 Apr 2008 17:16:30 -0700,
Mike wrote:
> 
> > To recap, the attack looks like this:
> > 
> > 1. Alice gets a certificate with key pair K_pub, K_priv.
> > 2. The attacker gets his own certificate with K_pub, K_priv
> >    under his own name.
> > 3. Alice connects to the server and offers to authenticate
> >    using certificate_url.
> > 4. The attacker intercepts the server's connection to the
> >    URL provided by Alice and substitutes his own certificate.
> > 5. The server now thinks that any data sent by Alice was
> >    actually sent by the attacker.
> 
> But won't the CertificateVerify message fail since the attacker
> has a different private key than Alice?

No, because the attacker is presenting a certificate with
Alice's public key and Alice is doing the signing. Remember
that the key to the attack is that the attacker is able to
get a cert for a name of his choice but with Alice's public
key.


> In any case, maybe the data that needs to be sent is not the
> hash of the certificate, but rather the identity the client
> wants to authenticate as.  This could be the subject DN, or
> SAN from the certificate.  An advantage of using that is that
> it is invariant even as the actual certificate is periodically
> reissued.

Perhaps yes, but that would require an actual change to the syntax of
the protocol, whereas this is just a new requirement to use the
existing syntax.

-Ekr

_______________________________________________
TLS mailing list
TLS@xxxxxxxx
https://www.ietf.org/mailman/listinfo/tls