Re: [TLS] The risk of misconfiguration

[Manuel Pégourié-Gonnard <[e-mail]>]

On 07/05/2014 19:38, Alyssa Rowan wrote:
> Meanwhile aDH denies us that option, and broadcasts our MITM
> susceptibility to Mallory.
> [...]
> So, what use of anon_DH ciphersuites aren't addressed better by this
> method, especially given the very clear additional perpass risk of
> keeping them in TLS v1.3 that we've outlined here? How can we do better?
> 
Side note: it seems to me that perpass is short for pervasive passive
(surveillance). Would you say the MitM risk you're describing here qualifies as
passive? (It might still be cheap enough to be implemented at a large scale by
some organisations doing pervasive surveillance, which is a serious problem indeed.)

Anyway, I'm not sure an adversary needs aDH as a marker to rather efficiently
guess which clients are going perform some kind of server authentication: for
example, if the server's cert is self-signed, and the client doesn't perform a
TLSA lookup, and the client and the server don't belong to the same
organisation, it's quite likely that the client isn't validating. I don't think
an adversary needs to be 100% sure here. They can probably also just try to MitM
clients and remember for which ones it worked.

Manuel.