Re: [TLS] Finished verify_data collision (Was Re: draft-turner-ssl-must-not)

[Marsh Ray <[e-mail]>]

On 07/08/2010 03:07 AM, Nikos Mavrogiannopoulos wrote:
> [...]
>> * Mitm needs to obtain the client's premaster secret as part of the attack
>> (the key material is needed to generate the hash). Note this is trivial with
>> some real clients in common use that don't validate the server cert until
>> they receive the Finished message.
>
> Why is this trivial?

Mitm can present his own cert that he has the private keys to. It might 
be self signed, signed by a CA cert calling itself "Verisign", or signed 
by the real Verisign but issued to mitm.example.com.

Another possibility is that he could downgrade the connection to 
something he could break.

> If you do mitm it will be discovered at the
> verification point and game is over.

Maybe not. Attacker may have accomplished his objective, he may only 
need 50 ms of unauthorized access (or to commit one transaction) in 
order to install a persistent backdoor.

Considering the lack of concern typical web users have for certificate 
warnings, I think there's plenty of room for an attacker to avoid or 
delay detection. When was the last time you compared the binary RSA 
parameters on a cert warning? A successful attack on unattended systems 
may be recorded in the logs as simply a single connection failed.

- Marsh