Re: [pkix] How do we differentiate authentic servers from proxies performing TLS interception?

["Miller, Timothy J." <[e-mail]>]

> Actually, the use case I most often encounter is the one where "a priori"
> knowledge exists, and we don't really need to turn to DANE, TOFU pinsets
> and the like. However, we have to re-use existing infrastructure, like a TLS
> channel and web services.

Your original three operative conditions actually degenerates to two:

(1) There's no MitM.
(2) There's a MitM.

Binding authorities to names by any means--including out-of-band--gives you the information to decide which condition you're in.  After that point you have to decide what to do about it.  Binding authorities to names could be addressed in TLS (or HTTP or DNS), but it's not a PKIX problem.  PKIX only addresses namespace restrictions when cross-certification use cases (though MS has adapted those mechanisms for qualified subordination). 

Legitimacy of the MitM is irrelevant at the technical level; legitimacy is a human decision that varies by jurisdiction.  *Identity* of the MitM is relevant because it informs how you would respond.  That's part of the reason why RFC 7469 permits an escape in Sec 2.6 using user-defined trust as the example (which, it should be noted, is exactly how Chrome currently behaves).

-- T