Re: [TLS] Handshake not under protection

[Michael D'Errico <[e-mail]>]

Geoffrey Keating wrote:
> Michael D'Errico <[e-mail]> writes:
> 
>> If a DHE cipher suite is used, then the server can be authenticated
>> using only Certificate and ServerKeyExchange.  With RSA cipher suites,
>> you are correct that a client doesn't authenticate the server until
>> Finished verifies.
> 
> I think that still doesn't prove that there is no man in the middle.
> The MITM could forward the ClientHello to the real server, which will
> return a signed ServerKeyExchange with the correct client_random and
> server_random.  The MITM won't be able to use the associated DH
> parameters but they aren't necessary until later in the exchange.

Yes, you are right.  A MitM can not sign the ServerKeyExchange himself,
but he can just ask the real server to do it.

But this thread is about sending a client certificate in a renegotiation
handshake, so there should be no MitM (if the client has validated the
first handshake).

Perhaps I misunderstood what was being asked.

> Another approach, of course, is to not put unnecessary personal
> information in the client certificate in the first place.

I have seen someone send a client certificate to my server with a
subject that had most attributes containing the string "confidential"
and the commonName was basically a unique ID.  The only possibly
identifying information was the country code, and based on a recent
PDF I've read I have a "theory" of who it was!  ;-)

Mike