Re: [TLS] Implementation survey: Client Certificate URL extension

[<Pasi.Eronen at nokia.com>]

Martin Rex wrote:
> Pasi.Eronen at nokia.com wrote:
> > 
> > This vulnerability of Client Certificate URL is already described in
> > the Security Considerations text in RFC 4366, so it isn't anything
> > particularly new.
> > 
> > In the context of web browsing over TLS, it isn't really different
> > than, say, the ability to include IMG URLs pointing to arbitrary
> > hosts (not just the one the HTML page came from).
> 
> It is completely different!
> 
> The regular HTTP/HTML based attacks attack the client/browser.
> 
> The certificate extensions and the client-cert-URL extension for TLS
> attack the server, and there is no "must visit a hostile website"
> involved at all, the server is guaranteed to fall prey to every
> attack automatically if it supports/implements such a feature (or
> "inherits" this feature from the underlying middleware).

You're quite right, I wasn't thinking clearly -- this is indeed
quite different, since it targets the server.

Nevertheless, it is described in RFC 4366 already; do you think
there's something more we should add in 4366bis?

Best regards,
Pasi
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls