Re: [TLS] TLS document status update

[<Pasi.Eronen at nokia.com>]

Mike wrote:
> But how could the substitution attack even succeed?  You would need
> to create a valid CA signature on the replacement certificate, which
> should not be possible.

This has been explained couple of times earlier, but let me recap
one scenario:

Assume that the client has several certificates (all of which are
properly issued by valid CAs) that contain the same public key, but
different subject names.

For example, one of the subject names could identify the user as an
employee of Example Inc; another name could be his personal identity;
third one might be an administrator/superuser role; etc.

(In this example, nobody's keys have been compromised, all CAs are
behaving exactly as they should, proof-of-possession is being done,
etc.)

If the hash is not included, the client could send an URL to the first
certificate, but the attacker could replace it with the third
certificate.  Given that TLS is a building block that's used in large
variety of applications (and will be used in the future for things we
don't know about yet), it's not totally unplausible that more than one
of these certificates could be acceptable to a server, and it would
behave differently for them.

(You could of course argue that the user should have used different
private/public key pairs when requesting these different certificates,
but that's not always done. You could also argue that since all the
certificates belong to the same user, there's no attack, but I don't
agree with that one.)

Best regards,
Pasi
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls