Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Viktor Dukhovni <[e-mail]>]

On Tue, Jul 28, 2015 at 04:54:58AM +0000, Christian Huitema wrote:

> OS is by definition prone to MITM attacks, including downgrade attacks.

[ Yes, when not authenticated.  There's also downgrade-resistant OS, via
  e.g. DANE, but not widely deployed at present. ]

> Just negotiating any which algorithm key that comes out of the channel is
> too dangerous for my taste. If we do OS we should also enable a form of
> MITM detection, maybe channel binding. It will not be used in all OS
> connections, but using it in some connections in an unpredictable should
> be enough to detect and deter mass deployment of MITM.

I agree this is desirable, but it is rather difficult to make MiTM
detection practical in many cases, e.g. email.  Sure one could log
channel-unique tags on both sides, but who's going to ever compare
them?

One might propagate the tags along the forward-path in new trace
headers, but those would need to be signed by the previous-hop MTA,
at which point, we're no longer talking about unauthenticated
opportunistic TLS.

The trick is finding a way to make it possible and worthwhile for
a sufficient fraction of participants to add the requsiite checks.
This can work for interactive protocols (humans on phone verbally
verify matching channel-ids), but is rather difficult for
store-and-forward.

For SMTP transport at least, DANE looks like a more promising
counter-measure to active attacks.

-- 
	VIktor.