Re: [TLS] Collisions (Re: Consensus Call: FNV vs SHA1)

[Nicolas Williams <[e-mail]>]

On Mon, May 10, 2010 at 04:56:52PM -0500, Nicolas Williams wrote:
> On Mon, May 10, 2010 at 11:48:09PM +0200, Simon Josefsson wrote:
> > It seems a server could easily create two pairs of server certificates
> > that results in the same FNV-1a value but are different certificates.  A
> > client connecting to a server offering a cached value for the server
> > certificate would not know which server certificate was intended, even
> > after completing the handshake.  If correct, that seems surprising.
> 
> If the server figures it out, who cares.  If not, bad.

I didn't think this through yesterday.  Let me try again.

The only way the collision could happen and the handshake succeed is (at
least for the cipher suites I've thought about) if a) the two certs have
the same public key, b) the client had seen one or both server certs
earlier.

And the attack?  I think it could be mostly harmless because the server
thinks the client authenticated the server as one entity name while the
client thinks it authenticated the server as another -- but both server
names must have been reasonably close to equivalent (HUGE assumption;
keep reading).  Sure, the client could get redirected to another server,
but only if the incorrect cert was properly signed, and only if the
client cache learns about that object (more assumptions).

The devil's in the details!

Some of those devilish details:

 - Clients MUST NOT cache objects from failed handshakes.

 - Clients MAY cache objects from succesful handshakes, and only when
   the clients authenticate the server (including validation of the
   server's cert chain to a TA).

 - In particular there MUST NOT be any caching in cases where the server
   is authenticated by the use of pre-shared certificates.

    - There must be no chance of caching objects when a user clicks
      through one of those "give your money to the bad guys?" dialogs.

Any others?  Yes, I should review the document closely now.

Nico
--