Re: [TLS] Handshake not under protection

Michael D'Errico <> Mon, 21 December 2009 20:31 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id E256B28C161 for <>; Mon, 21 Dec 2009 12:31:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.549
X-Spam-Status: No, score=-2.549 tagged_above=-999 required=5 tests=[AWL=0.050, BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id BZaxFNM6fa2f for <>; Mon, 21 Dec 2009 12:31:50 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id DBED428C15F for <>; Mon, 21 Dec 2009 12:31:49 -0800 (PST)
Received: from (unknown []) by (Postfix) with ESMTP id 10BCB8AA00 for <>; Mon, 21 Dec 2009 15:31:33 -0500 (EST)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed;; h=message-id :date:from:mime-version:to:subject:references:in-reply-to :content-type:content-transfer-encoding; s=sasl; bh=FO9H8ePaTjgn 1NmnKycNakA3d7o=; b=NCDLgXTgJfNlp4n2y6NHcCssO7Bl89lc1myI17oAS1Do nZ/ls/LiUWpyD2EuVyvIdMmd/BSIPV63Ur1syr7x+X2XzNk92AZQf29fDOb5KmL/ bAiLv8l0wHTroXA5f3gIrMiT7YyzcTiKBZOXvgM9gCA9XThZHn+NUWhnPFkPf5c=
DomainKey-Signature: a=rsa-sha1; c=nofws;; h=message-id:date :from:mime-version:to:subject:references:in-reply-to :content-type:content-transfer-encoding; q=dns; s=sasl; b=WkGoO6 cwcUq1UCTQfHcz4QrANjARhmVBblBAd9yEgAjAZZwFUik8/XilH1/IlGUrWBBWk8 IXvzgwi6lzVhegSqnYdw5fzgupVgm5W9JPp+aTVB+nhAKH0GReP6npNsOzQ5Dx6u EcrOCliNpkmZ3oFBPmofq1XBvIF/aIqH50Mko=
Received: from a-pb-sasl-quonix. (unknown []) by (Postfix) with ESMTP id 0D4038A9FF for <>; Mon, 21 Dec 2009 15:31:33 -0500 (EST)
Received: from administrators-macbook-pro.local (unknown []) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id 80E388A9FE for <>; Mon, 21 Dec 2009 15:31:32 -0500 (EST)
Message-ID: <>
Date: Mon, 21 Dec 2009 12:33:23 -0800
From: Michael D'Errico <>
User-Agent: Thunderbird (Macintosh/20090812)
MIME-Version: 1.0
References: <>
In-Reply-To: <>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Pobox-Relay-ID: D3D22C9E-EE6F-11DE-B7EE-DC0DEE7EF46B-38729857!
Subject: Re: [TLS] Handshake not under protection
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 21 Dec 2009 20:31:51 -0000

Martin Rex wrote:
> Marsh Ray wrote:
>> Martin Rex wrote:
>>> Marsh Ray wrote:
>>>> At the TLS level, it's possible for the current session to be
>>>> anon-anon-DH, which provides no protection.
>>> And which rfc-5246 requires to _not_ request a client certificate:
>>>    7.4.4.  Certificate Request
>>>    When this message will be sent:
>>>        A non-anonymous server can optionally request a certificate from
>>>        the client, if appropriate for the selected cipher suite.
>> The client cert is requested in the renegotiating handshake, not the
>> initial one.  An anon-anon-DH session provides no "protection" for the
>> client cert passed in renegotiation.
>> But it probably makes some people feel more secure to not see the
>> details (usernames, emails, phone numbers, street addresses) flying by
>> on the wire.
> OK.  You are correct.
> That provision in 7.4.4. is about the _current_ handshake only
> and refers to the fact that a server has sent a "Certificate"
> message prior to CertificateRequest.  Since at the point of
> the handshake, the Server is _not_ authenticated.  There could have
> been a certificate path validation of the server certificate,
> but there is no proof yet, that the alleged server knows the
> necessary private key to the presented certificate, so this
> restriction in 7.4.4. does not provide security.

If a DHE cipher suite is used, then the server can be authenticated
using only Certificate and ServerKeyExchange.  With RSA cipher suites,
you are correct that a client doesn't authenticate the server until
Finished verifies.