[Dance] Re: Last Call: <draft-ietf-dance-client-auth-09.txt> (TLS Client Authentication via DANE TLSA records) to Proposed Standard

[Muhammad Usama Sardar <[e-mail]>]

On 16.12.25 20:55, Eric Rescorla wrote:

> I apologize for catching these so late, but it does not
> appear that these documents were sent to TLS-WG prior to being sent to
> IETF LC, so this is the first time I am reviewing these.
I also think it was not sent to TLS WG. At least, I haven't seen it before.
> # Cross-Protocol Attacks
>
> S 2.1 of client-auth contemplates that the client might have multiple 
> identities
> corresponding to different applications. If these services have the
> same public key, it appears that an attacker could mount a
> cross-protocol attack there traffic is redirected from one service to
> another.
>
> Arguably, this attack already exists if the server uses the same
> identity for both protocols, but it seems possible that there might be
> a setting in which this was inferred solely from something like the
> client IP address. In any case, it seems like it would be better for
> the service identifier to be included in the transcript.

I strongly suggest this should be resolved before proceeding with next 
steps on this draft. A couple of my collaborators have worked on related 
formal analysis (ProVerif code [0] and paper [1]). I recommend draft 
authors to reach out to them to ask if they can possibly extend their 
analysis to get a confirmation on this.

Moreover, I am not sure why the security considerations section is 
talking mostly about privacy. I believe privacy parts should be in a 
separate privacy considerations section.

-Usama

[0] https://github.com/moustafamariam/tls-rpk

[1] https://link.springer.com/chapter/10.1007/978-3-031-79007-2_4