Re: [TLS] The risk of misconfiguration

[Viktor Dukhovni <[e-mail]>]

On Wed, May 07, 2014 at 07:25:50PM +0100, Alyssa Rowan wrote:

> > Even though the server has a certificate, it still enables ADH and 
> > AECDH cipher-suites.  Clients that don't authenticate the server 
> > negotiate ADH or AECDH cipher-suites.  If the server happens to 
> > publish TLSA RRs, some *clients* will omit ADH and AECDH from
> > their cipherlist because they are going to authenticate the
> > server's certificate.
> 
> ...and my point is, Mallory can trivially spot the difference and
> knows it can MITM those clients with impunity. That's more dangerous
> for perpass: specifically, ubiquitous surveillance of mail text and
> metadata via GCHQ's project TEMPORA.

This is not a compelling reason to remove protocol capabilities.
I am against banning power tools.  Build them as safely as possible
at reasonable cost.

Both NULL and ADH/AECDH ciphersuites have real use-cases.

  - NULL ciphers should never be offered in combination with non-NULL
    ciphers.

  - ADH/AECDH ciphers are building blocks for using TLS with channel-
    binding to implement non-X.509 authentication systems.  They
    also reduce server work-factor and handshake bloat when
    opportunistic clients don't check certificates.  Cipher-suite
    signalling is just one of many ways that Mallory can determine
    which clients she can attack undetected.

-- 
	Viktor.