Re: review of draft-wierenga-ietf-sasl-saml-00

[Martin Rex <[e-mail]>]

Klaas Wierenga wrote:
> 
> On 5/26/10 8:28 PM, Sam Hartman wrote:
> > 
> > 1) The IDP MUST verify that channel binding data is asserted by the
> > expected RP and has been modified by no other party
> >
> > 2) The client MUST verify that the channel binding data corresponds to
> > the channel that is in use.
> >
> > Those two are enough that the user will learn through the web browser if
> > the connection is under attack.  However, the that's not enough to
> > defend against a server that fakes successful authentication or to learn
> > at the SASL protocol level about a channel binding failure.
> 
> Just to understand, what does channel binding buy you if you still can 
> not prevent the MiTM?

That is a misunderstanding.  (Cryptographic) channel bindings reliably
protects you from MitM attacks.  But it can not protect you from
an attacker that can successfully impersonate a "trusted" server,
and neither from an inappropriately trusted "rogue" server.

Successfully impersonating a "trusted" server does not necessarily
require a full compromise of that server.  Being able to pass those
few superficial checks that the client performs in order to verify
the authentication of a server is perfectly sufficient -- and is
usually much easier than breaking into the real server in order to get
hold of its credentials.  Think of PKI, X.509 certs, server endpoint
identification similar to HTTP over TLS (rfc2818) and the problem
of lots of software dealing with embedded NUL chars in names,
or the problem of huge amounts of interchangeably-trusted root CAs.


-Martin