Re: [TLS] Handshake not under protection

Michael D'Errico <> Mon, 21 December 2009 23:28 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 811523A687D for <>; Mon, 21 Dec 2009 15:28:22 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.55
X-Spam-Status: No, score=-2.55 tagged_above=-999 required=5 tests=[AWL=0.049, BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id VQ63CEI2O02L for <>; Mon, 21 Dec 2009 15:28:21 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 7BEBC3A67A1 for <>; Mon, 21 Dec 2009 15:28:20 -0800 (PST)
Received: from (unknown []) by (Postfix) with ESMTP id BAA188A848 for <>; Mon, 21 Dec 2009 18:28:03 -0500 (EST)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed;; h=message-id :date:from:mime-version:to:subject:references:in-reply-to :content-type:content-transfer-encoding; s=sasl; bh=Rz7ExXQY7FUe G/dpytUGDVPBXRY=; b=xuxkI7xNL37i+yL52bDQ0SkiVgZC0Fv0p2ZmwY1AaFDY X8Bj6zNlkOVkKms7CMwaIvxKOZT05o/PO/Ln3oAsqHXIe8vJo9eZ+dZbJzP6JQ68 RGrrfCMPgN0NQKIFBL3TZfkAIUujuOPhozj+uv841Mdq52GSwzenu27LTSdAw40=
DomainKey-Signature: a=rsa-sha1; c=nofws;; h=message-id:date :from:mime-version:to:subject:references:in-reply-to :content-type:content-transfer-encoding; q=dns; s=sasl; b=xSbk+v hCJl+PY/ASWETKLCWO1K1C50lV3gk9na2hgvEm0pZrIPnG2CBfv0nMlCxBIsRFkH ONF9W2ml45A+lYvSo474oesr0nWiH5d/Z4RgtBR/w/k8AA7/THN5D8VLMaTxl3fT 3VoM8Kq/MUV8uj5hRHnmrSCQ46xtiG248n3k4=
Received: from a-pb-sasl-quonix. (unknown []) by (Postfix) with ESMTP id B735C8A847 for <>; Mon, 21 Dec 2009 18:28:03 -0500 (EST)
Received: from administrators-macbook-pro.local (unknown []) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id 645C58A846 for <>; Mon, 21 Dec 2009 18:28:03 -0500 (EST)
Message-ID: <>
Date: Mon, 21 Dec 2009 15:29:45 -0800
From: Michael D'Errico <>
User-Agent: Thunderbird (Macintosh/20090812)
MIME-Version: 1.0
References: <> <> <m2bphsht9m.fsf@localhost.localdomain>
In-Reply-To: <m2bphsht9m.fsf@localhost.localdomain>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Pobox-Relay-ID: 7C5E40CE-EE88-11DE-9334-DC0DEE7EF46B-38729857!
Subject: Re: [TLS] Handshake not under protection
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 21 Dec 2009 23:28:22 -0000

Geoffrey Keating wrote:
> Michael D'Errico <> writes:
>> If a DHE cipher suite is used, then the server can be authenticated
>> using only Certificate and ServerKeyExchange.  With RSA cipher suites,
>> you are correct that a client doesn't authenticate the server until
>> Finished verifies.
> I think that still doesn't prove that there is no man in the middle.
> The MITM could forward the ClientHello to the real server, which will
> return a signed ServerKeyExchange with the correct client_random and
> server_random.  The MITM won't be able to use the associated DH
> parameters but they aren't necessary until later in the exchange.

Yes, you are right.  A MitM can not sign the ServerKeyExchange himself,
but he can just ask the real server to do it.

But this thread is about sending a client certificate in a renegotiation
handshake, so there should be no MitM (if the client has validated the
first handshake).

Perhaps I misunderstood what was being asked.

> Another approach, of course, is to not put unnecessary personal
> information in the client certificate in the first place.

I have seen someone send a client certificate to my server with a
subject that had most attributes containing the string "confidential"
and the commonName was basically a unique ID.  The only possibly
identifying information was the country code, and based on a recent
PDF I've read I have a "theory" of who it was!  ;-)