Re: [TLS] TLS document status update

[Mike <mike-list at pobox.com>]

> To recap, the attack looks like this:
> 
> 1. Alice gets a certificate with key pair K_pub, K_priv.
> 2. The attacker gets his own certificate with K_pub, K_priv
>    under his own name.
> 3. Alice connects to the server and offers to authenticate
>    using certificate_url.
> 4. The attacker intercepts the server's connection to the
>    URL provided by Alice and substitutes his own certificate.
> 5. The server now thinks that any data sent by Alice was
>    actually sent by the attacker.

But won't the CertificateVerify message fail since the attacker
has a different private key than Alice?

In any case, maybe the data that needs to be sent is not the
hash of the certificate, but rather the identity the client
wants to authenticate as.  This could be the subject DN, or
SAN from the certificate.  An advantage of using that is that
it is invariant even as the actual certificate is periodically
reissued.

Mike
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls