Re: [TLS] Request for review: Next Protocol Negotiation Extension

[Marsh Ray <[e-mail]>]

On 08/18/2010 03:59 PM, Adam Barth wrote:
>
> We're not trying to solve cross-protocol attacks for every protocol in
> the work.  We're trying to design a new protocol that is immune to
> cross-protocol attacks.

But, by definition, such an attack involves arbitrary other protocols.

> On Wed, Aug 18, 2010 at 2:37 AM, Juho Vähä-Herttua<[e-mail]>  wrote:
>> Further, protocols inside TLS are already implicitly weakly protected if the
>> endpoints require authentication.  There isn't any way that my web browser
>> can carry out an HTTPS cross-protocol attack against an SMTPS server, unless
>> the attacker already knows the appropriate SMTP credentials or I have client
>> certs accepted by the SMTPS server loaded in my browser.  Any attempt the
>> browser makes at authenticating via HTTP mechanisms is going to be ignored

TLS normally provides decent authentication. Cross-protocol attacks over 
TLS connections are only possible because the authentication only covers 
the DNS name of the server.

It should probably also include the intended protocol. I've seen some 
hints of that with in various x509 fields, but they don't appear to be 
marked 'critical'.

> That's not an accurate understanding of how cross-protocol attacks
> work.  Whether or not we're inside a TLS tunnel, the issues are the
> same.  One way to understand this is to think about a VPN.  Clearly it
> doesn't matter whether the cross-protocol attacks are taking place
> inside an IPv6 tunnel, does it?

It seems like certificates could be used to authenticate the server's 
hostname and also the intended protocol (in both directions!), were it 
not for the distortions induced by the PKI business.

 >> by the SMTPS server.  If I require STARTTLS for SMTP, I'm in an even 
better
 >> position than if I were using just SMTPS, as the client cert issue 
is gone.
 >> (Would that the HTTP world actually believed in Upgrade: for 
starting TLS!)

Those mechanisms are typically subject to downgrade attacks.

- Marsh