Re: [TLS] Root certificates in server certificate chains

[Marsh Ray <[e-mail]>]

On 08/31/2010 11:54 PM, Matt McCutchen wrote:
> On Tue, 2010-08-31 at 21:49 -0500, Marsh Ray wrote:
>>
>> My guess is that an attacker could tell whether or not the client was
>> "taking the bait" and so he wouldn't pass the Finished messages at all
>> unless they were expected to validate at one or both ends.
>>
>> An aborted attack might not look much different to the legitimate client
>> and server than ordinary packet loss.
>
> What attack are you describing?  If the attacker replaces the entire
> Certificate message with one containing his public key chained to a
> bogus root certificate, that is just a MITM attack.

Yes, at times a very effective one.

> If the attacker
> does some tampering but does not replace the server's public key with
> his own, he has no way to generate valid Finished messages.

Why would he do something like that? Why even bring it up?

I don't know if this is what you had in mind, but on example might be 
that he only cares about a valid Finished message in one direction. For 
non-resumption handshakes, the client is forced to transmit his valid 
Finished message before he has a chance to validate much of anything 
about the server's identity or the handshake. Under certain conditions, 
certain servers will perform some "highly non idempotent" actions upon 
the receipt of the clients valid Finished verify_data.

- Marsh