Re: [TLS] MITM Attacks on Client Authentication after Resumption

[Watson Ladd <[e-mail]>]

Dear all,
This is the third time we've had a bug in the protocol in an area that was
supposedly fixed. In this case it's the interaction between two different
flows breaking a tacit assumption in the state machine, and the complex
semantics of session renegotiation, both of which were previously noticed
in 2009 with the Rex/Ray attack.

There are two ways to make apparently secure systems: make the system so
simple it can't have flaws, and make it so complicated we can't find the
flaws. Luckily the authors are completing a verification which should
hopefully ensure that there aren't any more flaws. Unluckily we have
decided to make TLS 1.3. Will TLS 1.3 actually make a protocol so simple
that it has no flaws? Or will it continue to be filled with surprises?

Furthermore,  I would like to ask the chairs what they plan to do about the
clear issues in the process that this has exposed, and why users should
continue to trust TLS with confidential information.

Username password and cookies continue to be widely used in part because
client authentication in TLS has not had a good run. We need a new
mechanism for client authentication.

Sincerely,
Watson Ladd