Re: [TLS] Need for S->C signaling

[Yoav Nir <ynir at checkpoint.com>]

OK. So this is the case where the MitM has already sent the entire request, and the server decided it wants client authentication, and there is no session cookie that needs to be sent.

Although for nearly all HTTPS cases this won't work, I guess it could happen.
 
On Nov 20, 2009, at 12:29 AM, Marsh Ray wrote:

> Yoav Nir wrote:
>> 
>> But even if the server did send the CCS and Finished message, the
>> Finished message does not check out,
>> so the client does not complete the request. So where's the damage.
>         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> http://tools.ietf.org/html/rfc4346
>    Client                                               Server
> 
>      ClientHello                  -------->
>                                                      ServerHello
>                                                     Certificate*
>                                               ServerKeyExchange*
>                                              CertificateRequest*
>                                   <--------      ServerHelloDone
>      Certificate*
>      ClientKeyExchange
>      CertificateVerify*
>      [ChangeCipherSpec]
>      Finished                     -------->
>                                               [ChangeCipherSpec]
>                                   <--------             Finished
>      Application Data             <------->     Application Data
> 
>             Fig. 1. Message flow for a full handshake
> 
> 
> The client has to send his Finished message before he sees the server's.
> 
> The server executes the request when he receives Finished from the
> client. There is nothing later he can wait for, really.
> 
> MitM can drop the server's Finished message before the client gets a
> chance to verify it.
> 
> - Marsh
> _______________________________________________
> TLS mailing list
> TLS at ietf.org
> https://www.ietf.org/mailman/listinfo/tls
> 
> Scanned by Check Point Total Security Gateway.