Re: [TLS] Need for S->C signaling

[Stefan Santesson <stefan at aaa-sec.com>]

Thanks Nasko,

This is indeed a good reason.

/Stefan


On 09-11-19 4:32 PM, "Nasko Oskov" <noskov at microsoft.com> wrote:

> Stefan Santesson wrote:
>> Just a question to make sure we have accurately exhausted this aspect.
>> 
>> Is it really necessary for the Server to signal that is is patched other than
>> using a modified finished calculation if it is patched/upgraded.
> 
> Yes. If you use the finished message, the attack is still possible.
> 
>> One scenario could be:
>> 
>> 1) Client use the magic cipher suite to signal that it is patched/upgraded.
>> 2) Client sends a normal finished message.
>> 3a) Un-patched server replies with normal finished message.
>> 3b) Patched server replies with upgraded finished message.
>> 
>> This way the client could determine whether the server is patched or not
>> and act accordingly and get the security context of renegotiate from the
>> patched server.
> 
> Once the server replies with the Finished message, it would move to
> connected state and the HTTP stack is clear to execute the MiTM request. As
> part of developing proof of concept for our own testing, I've observed that
> connecting to IIS server will send the server CCS, Finished, App data.
> Even if the client were to drop the connection, the request has been
> executed and attack is carried out.
> 
>> There are probably reasons why this is not a good idea. I'm just not really
>> sure what they are.
> 
> _______________________________________________
> TLS mailing list
> TLS at ietf.org
> https://www.ietf.org/mailman/listinfo/tls