Re: [TLS] Root certificates in server certificate chains

[Matt McCutchen <[e-mail]>]

On Tue, 2010-08-31 at 20:56 -0500, Marsh Ray wrote:
> On 08/31/2010 07:09 PM, Matt McCutchen wrote:
> > The following is my understanding.  Others should feel free to disagree
> > or correct me.
> >
> > On Tue, 2010-08-31 at 22:30 +0000, [e-mail] wrote:
> >> The standard (RFC 5246, sec. 7.4.2) says that a server certificate
> >> chain may include, as the last entry in this chain, the root
> >> certificate that is to be considered the ultimate trust anchor as far
> >> the server certificate is concerned. What would prevent an attacker
> >> from inserting a Certificate message of its own during the handshake,
> >> containing a totally bogus root certificate?
> >
> > Like any other tampering with the handshake, this would cause the
> > Finished check to fail.
> 
> Not if the attacker is successful in getting the client to accept his 
> proposed root certificate.

I think we are answering different questions.  The attacker can of
course act as a MITM using the proposed root certificate.  But any
manipulation of the handshake between two parties that falls short of a
full MITM will prevent the Finished check from passing, unless the
attacker can cause a rollback to a cipher suite he can break in order to
forge the Finished messages.

-- 
Matt