Re: [TLS] TLS document status update

[Nikos Mavrogiannopoulos <nmav at gnutls.org>]

Mike wrote:

>>> White-listing of hosts from which the server is willing to fetch those
>>> client cert URLs effectively solves the other problems without
>>> necessitating any mandatory hashes.
>> No, it doen't solve the substitution attack.
> 
> But how could the substitution attack even succeed?  You would need
> to create a valid CA signature on the replacement certificate, which
> should not be possible.

The fact that you cannot present an attack doesn't mean there is no
attack, or that a combination of such weaknesses might be exploitable.
The TLS handshake finished message hashes protect the certificate by
including it. If the certificate is not exchanged during the handshake
then this protection is no longer available.

So:
1. If this protection is not really required, then it can also be
removed it from the original TLS handshake.

2. If this protection is required, then it should be present in the
abbreviated handshake with the certificate URL (in the form of
certificate hash), so equivalent security is offered by equivalent
ciphersuites.

regards,
Nikos
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls