Re: [TLS] User Defined Key Pair

["Blumenthal, Uri - 0558 - MITLL" <[e-mail]>]

>From the answers provided so far, it looks like there is no server
authentication. So if you pretend to be a server, get user name and
password, then pretend to be that user to, e.g., Facebook ­ you should get
complete access, including the ability to generate your own key pair. :)

I'd much prefer dependence on a 3rd party ­ Certificate Authority, to be
precise.
--
Regards,
Uri Blumenthal

From:  Paras Shah <[e-mail]>
Date:  Tuesday, June 25, 2013 1:25
To:  "Stephan T." <[e-mail]>, "OMAR HASSAN (RIT Student)"
<[e-mail]>, "[e-mail]" <[e-mail]>
Subject:  Re: [TLS] User Defined Key Pair

> That is exactly the question I had. How is Server Authentication done with
> this approach?
>  
> 
> From: [e-mail] [mailto:[e-mail]] On Behalf Of Stephan
> T.
> Sent: Monday, June 24, 2013 10:24 PM
> To: OMAR HASSAN (RIT Student); [e-mail]
> Subject: Re: [TLS] User Defined Key Pair
>  
> 
> Hi,
> 
>  
> 
> How you made sure that the user (client) is connected with the intended
> server?
> 
>  
> 
>  
> 
> -Stephan
> 
>  
>  
> 
> Am 21.06.2013 um 20:35 schrieb OMAR HASSAN (RIT Student) <[e-mail]>:
> 
> 
> Hello All,
> 
>  
> 
> I have uploaded a new version of the User Defined Key pair protocol that is
> cleaner and briefer, I will appreciate any comments or suggestions.
> 
>  
> 
> Just to remind you:
> 
>  
> 
> http://tools.ietf.org/html/draft-omar-tls-udkp-01
> <http://tools.ietf.org/html/draft-omar-tls-udkp-01>
> 
>  
> The new protocol is a new way of securing the traffic to websites without
> being depending on any third party to secure the traffic between the user and
> the website, so it will be possible for the user to secure his browsing using
> his credential information, smart card, or a random file on usb. That will
> make the use of two factor for authentication and traffic security is
> separated from the application code, the website admin only needs to configure
> how the users are going to access the website. Additionally there are no
> passwords required to be transferred any more on the network, which will
> render the Phishing attack useless.
> 
>  
> 
> The motivation behind the new protocol is to make the security the
> responsibility of the two involved parties, because as you know, the security
> and confidentiality of user browsing in TLS depend upon the number of
> Certificate Authorities (CAs), major web browsers trust hundreds of different
> firms to issue certificates. Each of these
> firms can be compelled by their national government, or being compromised to
> issue a certificate for any particular website that all web browsers will
> trust without warning.Thus, users around the world are put in a position where
> their browser entrusts their private data, indirectly, to a large number of
> governments, and entities. (http://cryptome.org/ssl-mitm.pdf
> <http://cryptome.org/ssl-mitm.pdf> )
> 
>  
> 
> Thank You
> 
> Best Regards
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>