Re: [TLS] Summary of discussion regarding spontaneuous authentication

[Ilari Liusvaara <[e-mail]>]

On Wed, Oct 22, 2014 at 05:07:29AM -0700, Martin Thomson wrote:
> I forgot one point that we discussed.
> 
> We discussed the removal of the CertificateRequest and we will permit
> the client to unilaterally send authentication.

CertificateRequest has fields certificate_types and
supported_signature_algorithms (there's also third field, but IMO
that's better sent at application level). Where is the equivalent
data put?
 
> On 22 October 2014 03:04, Martin Thomson <[e-mail]> wrote:
> > The update proposal that ekr sent around was discussed.
> >
> > The primary concern was that the properties of the connection were
> > considered to change with respect to authentication.  Any data
> > received before the authentication, or messages that appear partially
> > before and partially after would have ambiguous properties.
> >
> > Concerns were raised that having the authentication attest to data
> > that was sent prior to the authentication would expose us to a variety
> > of attacks that relied on confusion about the state of the connection.
> > There was also a concern that this would be difficult to analyse.

The behaviour of authentication credentials being updated mid-connection
is highly application-dependent.

In practicular, any application protocol wanting to support such thing
needs to carefully specify, in race-free way, what authority applies
to each piece of data.

So client doesn't send piece of data, thinking it is using authority A,
but server goes and interprets it using authority B.

And for some applications, one wants to be possible to have multiple
authentications at once.

Client and server being confused about authority results in security
holes. And those holes are being exploited in the wild.

> > It was pointed out that update was still interesting, but only from a
> > rekeying perspective, because that had far lesser risks and no real
> > API implications.

Note that rekeying interacts with TLS-EXTRACTOR, which is part of API.

In practicular, how to avoid race conditions between key update and
use of TLS-EXTRACTOR output?


-Ilari