Re: [TLS] [tls13-spec] relax certificate_list ordering requirements to match current practice (#169)

[[e-mail] (Martin Rex)]

Yoav Nir wrote:
> 
>> Brian Smith <[e-mail]> wrote:
>> 
>> When you fetch CRLs or OCSP responses, you are using a URL that has been
>> authenticated by a trusted issuer, assuming you do revocation checking
>> from the root to the end-entity, which is the safer way of doing it.
>> Whereas, in AIA cert fetching you are making a request to an
>> unauthenticated URL. That is quite a big difference, because it is
>> much harder to get a CA to sign a certificate with your chosen OCSP URL
>> than it is to just forge your own certificate with whatever
>> AIA caIssuers URL you want to have.
>>   [...]
>> Consequently, we shouldn't accept AIA cert fetching as good or even
>> reasonable behavior based on analogies to revocation information fetching.
> 
> I see. I understand the difference, I just don?t think it matters.
>   [...]
> I agree that this increases the attack surface, but what kinds of
> attacks are we talking about?


In the TLS WG, we do not need to defer PKIX specifications for dangerous
behaviour, because such behaviour was already proposed in the very first
TLS extensions document (rfc3546), and equipped with security considerations
that give a glimpse at the attackers vast possibilities from such a facility.

https://tools.ietf.org/html/rfc3546#section-6.3


-Martin