Re: [TLS] TLS 1.2 hash agility

[Eric Rescorla <ekr at networkresonance.com>]

At Thu, 27 Sep 2007 09:49:35 -0700,
Mike wrote:
> > Remember that the signature over
> > the client's certificate and CertificateVerify is for the 
> > client's benefit, not the servers, and vice versa....
> 
> I thought that the signature over the client's certificate
> was to prove to the server that you have the corresponding
> private key, and therefore that you are the entity named in
> the certificate (and deserve access to private information
> about that entity).

Yes, I agree with this. My point is that the enforcement of
the client's identity *must* happen by the server. There
is nothing the client can do to force the server to enforce
a strong policy for client auth.

Consider the following case:

- SHA-1 has been broken.
- I have a classic RSA certificate signed with RSA-SHA-256.
- The server isn't under my control and foolishly accepts SHA-1.

No matter how I configure my client, an attacker can impersonate
me and sign with SHA-1 and the server will accept it.

-Ekr







_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls