Re: [TLS] simplistic renego protection

[David-Sarah Hopwood <[e-mail]>]

Michael D'Errico wrote:
> If a client doesn't check the server's certificate, it is subject to
> any man-in-the-middle attack.  One of the requirements is that a client
> verify the certificate.  If a client doesn't do that, how can we
> possibly protect it???

The important case here is where client certificates are involved.
Normally, a MITM would not be able to authenticate its connection to
the server using a client cert held by the actual client -- that cert
authenticates only the connection from client to MITM, and replaying
the CertificateVerify message (in the case of a client cert with
signing ability) does not work.

Therefore, the form of the attack described by Marsh does break a
security property that TLS is intended to guarantee, independent of
any checking by the client of the server certificate.

Does anyone use "fixed_dh" client certs that lack signing ability, BTW?

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com