Re: [saag] SHA-1 to SHA-n transition

[Eric Rescorla <[e-mail]>]

At Sat, 21 Feb 2009 11:10:03 -0500,
Stephen Kent wrote:
> I agree wit Phil's suggestion that we begin work on this topic sooner 
> rather than later.  Solutions probably will require coordination 
> between folks in both PKIX and TLS, plus some browser experts from 
> the APP area.

I should note that TLS 1.2 already has support for SHA-n, as
well as mechanisms for indicating that an implementation 
will accept these certificates. Deployment of 1.2 has been
minimal so far, but I'm not aware of any new protocol design
work that needs to be done here.

> Since we're talking about how well browsers implement PKI mechanisms 
> in the context of SSL/TLS, it is worth noting a presentation at last 
> week's Black Hat conference in D.C. The presentation provided details 
> on how several browsers remain vulnerable to attacks because they 
> fails to check the Basic Constraints extension. This oversight of one 
> of those pristine principles of PKIX ( we can use the acronym P3 
> going forward) and allows a web sites to act as a CA, based o the EE 
> cert issued to it by any of the trust anchors embedded in the browser.

I agree that this is a problem.


> Another vulnerability, and matching MITM attack, is enabled by the 
> issuance of certs that contain wildcard DNS names. This is not, a 
> violation of P3, because PKIX caved to pressure from the TLS WG, to 
> accommodate web site operators who wanted to purchase one cert from a 
> TTP that could be used to verify the EE certs for multiple web sites. 
> I argued against this, but lost. The phrase "I told you so" comes to 
> mind :-).

Can you briefly describe how this leads to MITM attacks? This is something
I haven't heard before.

Best,
-Ekr