Re: [TLS] MITM Attacks on Client Authentication after Resumption

[Nico Williams <[e-mail]>]

[Cross-posting to [e-mail].  Please drop one of tls or kitten
when responding.  For KITTEN readers, see the TLS list archives,
there's an MITM vulnerability when using tls-unique in conjunction
with session resumption.]

On Mon, Mar 3, 2014 at 4:07 PM, Adam Langley <[e-mail]> wrote:
> On Mon, Mar 3, 2014 at 4:07 PM, Andrei Popov <[e-mail]> wrote:
>> It appears that the attack described is only feasible when two
>> implementation defects are present:
>
> That's not an unreasonable characterisation of the renegotiation-based
> attacks, but the problem with tls-unique is more fundamental.

The problem for tls-unique is more fundamental indeed, and Andrei's
characterization is not applicable.

We should talk about how to fix tls-unique.  The best fix may be to
keep track of the original (non-resumed) connection's tls-unique CB
and add that to the resumed connection's tls-unique CB.  This requires
adding to the session cache on the client side.

In the short-term, client and server applications should not permit
session resumption prior to channel-bound authentication (if using
tls-unique).  Except that, of course, how is the application to know
if session resumption is involved?  Assuming that it can't know or
prevent the use of session resumption, I'd say that tls-unique is just
simply not to be used.  We should publish a new tls-unique that
doesn't have this problem.

Nico
--