Re: [TLS] Proposal for detecting fraudulent certificates

[Martin Rex <[e-mail]>]

Florian Weimer wrote:
> 
> * Martin Rex:
> 
> > Having the client send _only_ the servers certificate and not the
> > entire certificate path should IMO be sufficient for the purpose you
> > outline.
> 
> I don't think it is.  The certificate itself is not proof of fraud if an
> intermediate CA is involved.  More importantly, you cannot tell an
> intercepting corporate proxy (whose certificate is not rooted in the
> browser PKI) from a certificate which is.

The Web Server certificate nails down the public&private key for the
server.  If a MITM has access to the servers private key, then
you've lost already, because that MITM can perform a perfect
impersonation for the client (the only thing that the MITM could
not do is a client-certificate authentication to the real server
(unless the real server lacks rfc5746 renegotiation protection).


> 
> > I don't know why you think the 64 KByte TLS extension size limit would
> > be a problem.
> 
> The wire format allows for larger server chains (up to 16 MB).  This
> could be abused to bypass detection (just use a certificate with a
> logotype extension).  I just felt I had to say something about that.

The client could decide to not talk to such TLS servers at all
(while theoretically not "standards compliant", it is what a
 non-marginal fraction of the installed base is doing...)

Are you aware of this Microsoft Hotfix:
http://support.microsoft.com/kb/2541763

(Curiously, Search on support.microsoft.com seems unable to find
 this hotfix for keywords.  I know about it because it was offered
 by Windows Update--my Windows machines are on "manuall install").


-Martin