Re: [TLS] question on draft-ietf-tls-session-hash-03

Hi Tony,

To me it seems the sentence is correct as C really wants to connect to A thinking it is an honest server and doesn't know S is involved. Then S doesn't know the involvement of A as A connected unauthentified and forwards info from C.
But authors should confirm that in case I am mistaken...

Cheers,
B.

> On 24 Feb 2015, at 9:21 am, Tony Hansen <tony@att.com> wrote:
> 
> I have a question on draft-ietf-tls-session-hash-03. In the description I see:
> 
>    As described in [TRIPLE-HS], in both the RSA and DHE key exchanges,
>    an active attacker can synchronize two TLS sessions so that they
>    share the same "master_secret".  For an RSA key exchange where the
>    client is unauthenticated, this is achieved as follows.  Suppose a
>    client, C, connects to a malicious server, A.  A then connects to a
>    server, S, and completes both handshakes.  For simplicity, assume
>    that C and S only use RSA ciphersuites.  (Note that C thinks it is
>    connecting to A and is oblivious of S's involvement.)
> 
> My question is on the parenthetical comment at the end. I'll repeat it here, expanding C, S and A into CLIENT, SERVER and ATTACKER, respectively:
> 
> 					(Note that CLIENT thinks it is
>    connecting to ATTACKER and is oblivious of SERVER's involvement.)
> 
> Am I wrong in thinking that A and S are reversed here, and this should read:
> 
> 					(Note that CLIENT thinks it is
>    connecting to SERVER and is oblivious of ATTACKER's involvement.)
> 
> Or, removing the expansion:
> 
> 					(Note that C thinks it is
>    connecting to S and is oblivious of A's involvement.)
> 
> That is, ATTACKER A is the malicious man in the middle that the     client is not aware of. (For that matter, the server is also probably oblivious of A's involvement.)
> 
>     Tony Hansen
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls