Re: [TLS] MITM Attacks on Client Authentication after Resumption

[Bodo Moeller <[e-mail]>]

Martin Rex <[e-mail]>:

> Dr Stephen Henson wrote:
>


> > If the client checks the hostname against the certificate whenever a
> > certificate is presented[2] then additionally the attacker needs a
> certificate
> > with the same hostname as the attacked server.
> >
> > 2. This isn't always the case. Some applications check the hostname only
> after
> > the handshake has completed.
>


> An application client that is using a TLS library _without_ callbacks,
> and requests a blocking TLS handshake to be performed, will only get to
> see the server certificate after the handshake has completed.
>
> While the X.509 cert chain validation might be performed in-band
> by the TLS stack, the rfc2818 Section 3.1 server endpoint
> identification is left up to the application caller.


I certainly agree that there's an issue here, but I don't see how (in the
context of the Triple Handshake Attack) this is about whether a handshake
has completed.  Maybe what you (Steve and Martin) mean is that some
applications only check once, after the *initial* handshake on the
connection has completed (not checking again if another, renegotiation,
handshake completes)?

Bodo