Re: [TLS] Next Protocol Negotiation 03

[Adam Langley <[e-mail]>]

On Wed, Nov 14, 2012 at 6:30 PM, Andrei Popov
<[e-mail]> wrote:
> Here is an example active attack which could reveal the negotiated protocol:
> - MITM downgrades the cipher during TLS handshake.
> - MITM can decrypt EncryptedExtensions message and find out which application protocol has been negotiated between the server and the client.
> - Finished messages are exchanged, at which point the attack is detected and the session is aborted. But the attacker knows the application protocol that is likely to be negotiated between this server and this client in the future.

Ah yes, I'm sorry, in my mind I was trying to think of a way to
downgrade the protocol when you referenced that.

That attack can certainly cause the protocol to be sent using the
weakest cipher the the client supports (which is generally 3DES for
the clients in question).

However, I don't believe that your conclusion that this demonstrates
that the complexity isn't justified is correct. I think everyone
recognises that traffic is moving towards port 80 and 443 because of
filtering of TCP ports by middleware. If we create another plaintext
protocol negotiation then I'll be back here in a few years time with a
draft for NPN2 - because the plaintext negotiation will also be the
target of filtering.

The fact that a middlebox can perform an active attack and get the
protocol encrypted with 3DES doesn't affect that reasoning. I agree
that this is shade of security gray which is generally not something
that TLS deals with. None the less, I believe that it still has
significant value even through it's not white: the end-to-end
principle is worth defending.


Cheers

AGL