Re: [TLS] [oss-security] CVE-2009-3555 for TLS renegotiation MITM attacks

[Peter Gutmann <pgut001 at cs.auckland.ac.nz>]

Marsh Ray <marsh at extendedsubset.com> writes:

>For one thing, browsers' behavior of allowing automatic certificate sending
>is suspect and should be reconsidered.

It's not actually safe to reconsider this because many servers (including some
at very large sites) always request client auth, often without the site admins
being aware of this or knowing how to disable it.  I became aware of this when
I changed my code to add a roadblock until the user explicitly responded to a
client cert request, leading to many complaints about sites that formerly
"worked" and now didn't (I've found all sorts of other broken behaviour around
client-auth, for example servers that send a list of 150-odd CAs, every one
they know of, as an indication of who they'll accept certs from, and other
strangeness).  Disabling the automatic sending of client certs would therefore
obviously break, to the client, a number of (what I consider) broken servers.
What my code currently does is:

  if( cert request received )
      if( client cert present )
          send cert;
      else
          send no-cert alert;

This isn't totally safe though because there's no "tell user to make their
cert available" option if they haven't pre-emptively done so, it "works"
mostly because the extreme rarity of client cert use and stereotyped behaviour
of existing clients hides all the glitches in implementations.

Peter.