Re: [TLS] TLS identity protection using Signaling Cipher Suite Value

[Martin Rex <[e-mail]>]

Badra wrote:
> 
> I posted a document that defines a pecial Signaling Cipher Suite Value to
> enable the negotiation of the client identity protection. This approach had
> been initially proposed by Francisco Corella, to the TLS mailing list
> during August 2000.
> 
> http://www.ietf.org/id/draft-badra-tls-identity-protection-00.txt

A signaling cipher suite value is certainly *MUCH* better than
the other proposal for a cartesian product of common ciphersuites.

Although performing negotiation of this capability through ciphersuite
values instead of a TLS extension would protect against a very simplistic
DoS attack against a TLS handshake between the rightful client and
rightful server using TLS extension (but only in case the client is
capable and willing to perform a reconnect fallback with an
extension-less ClientHello),
this approach can *NOT* protect against an active attacker that
is determined to learn the client's identity and does not
care about causing a failed TLS handshake while doing so.

As I previously mentioned, the only reliable protection during the
handshake would be an indication from the server that is authenticated
by the server credential an can *not* be stripped from the handshake.
Basically, it would need to be hardwired into the server's credential,
like an additional certificate extension or a new EKU OID.

The Finished MAC protection of the handshake contents can only protect
the application from using the resulting connection, it can not
protect the negotiation and use of protocol features _during_
the TLS handshake because modifications of the handshake by an
active MitM can only reliably be detected *after* the handshake when
verifying the finished messages.

-Martin