Re: [TLS] Ideas for TLS 1.3: Server key continuity and certificate reporting

[Kai Engert <[e-mail]>]

On Fr, 2014-01-10 at 23:22 +0100, Kai Engert wrote: 
> > And that
> > is probably exactly what they'll do, because they do it already
> > (“QUANTUMRESET”) and it's a very, very easy attack; much easier than
> > getting a forged certificate.
> 
> Sorry, I don't understand this part of the argument.
> Where can I read more about "QUANTUMRESET"?

In the meantime I've learned what this is about. It's a mechanism to
implement MITM on a connection.

I believe your point is, it doesn't matter which pysical connectivity
option a client uses to connect to the Internet - because the adversary
doesn't need to manipulate connections close to the victim, but rather
could enforce that MITM remains always active for a particular client.

I agree, for state level attackers who can manipulate the Internet
backbone, this could block the ability of a victim to report a falsely
issued certificate to the real server.

Question is, is the quantum server really sufficiently reliable enough
to be active at all times, no expections? For each victim, a onetime
glitch or downtime would be sufficient to get the false certificate
reported.

Kai