Re: [TLS] question on draft-ietf-tls-session-hash-03

Yes, C wants to connect to A. A independently connects to S.
So in the outer TLS connection, there is no attack. (A is like an application-level proxy.)

Then during renegotiation after resumption, C authenticates with a client certificate to A
and A succeeds in forwarding C’s certificate to S, hence impersonating C at S.

There are other variations of the attack on various TLS channel bindings, 
but the above version (initial + resumption + renegotiation) is called the triple handshake attack.

Perhaps we could be a bit clearer about this in the spec? I am currently revising it to incorporate other comments on the list.

Best,
-Karthik

On 24 Feb 2015, at 16:12, Tony Hansen <tony@att.com> wrote:

> Thank you for the quick response. In my interpretation, I took things as "C really wants to connect to S, but got A instead". I didn't get your interpretation when I read it and re-read it. But I can see now how what you wrote would also be a valid interpretation.
> 
> I guess we'll await a response from the authors.
> 
>     Tony Hansen
> 
> Benjamin Beurdouche <benjamin.beurdouche at inria.fr> wrote:
>> Hi Tony,
>> 
>> To me it seems the sentence is correct as C really wants to connect to A thinking it is an honest server and doesn't know S is involved. Then S doesn't know the involvement of A as A connected unauthentified and forwards info from C.
>> But authors should confirm that in case I am mistaken...
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

Re: [TLS] question on draft-ietf-tls-session-hash-03

Attachment: signature.asc