Re: [TLS] Asking the browser for a different certificate

[Kyle Hamilton <[e-mail]>]

On Mon, Mar 29, 2010 at 1:03 PM, Michael D'Errico <[e-mail]> wrote:
> Kyle Hamilton wrote:
>>
>> I thought this was what the ADH ciphers were supposed to handle:
>> create a private channel, and then authenticate each end of that
>> channel inside the protection of the ciphered channel.
>
> There is no way to know if you've negotiated ADH with an attacker.

There's no way to know if you've negotiated ADH with an attacker --
but you've only got one attacker, Mallory.  If you have a whole bunch
of Eve's out there, who's to say they won't be able to put two and two
together and pinpoint you for attack even if you haven't connected to
a Mallory?

There is no way to know that Mallory will not broadcast the fact that
you connected with him under the pretense of being someone else, but
if he does that he's admitting to digital fraud and deceit anyway.

In most cases, I believe that security policies should make it more
expensive to recover a message than the message is worth -- but not an
order of magnitude more.  Maybe twice as expensive.  The more CPU time
used in attacking, the more electricity must be used (many, many watts
get dissipated as heat), which costs money.  The more sets of eyes
looking at it, the more costly it becomes.

-Kyle H