Re: [TLS] MITM Attacks on Client Authentication after Resumption

[[e-mail] (Martin Rex)]

Dr Stephen Henson wrote:
> 
> If the client checks the hostname against the certificate whenever a
> certificate is presented[2] then additionally the attacker needs a certificate
> with the same hostname as the attacked server.
> 
> 2. This isn't always the case. Some applications check the hostname only after
> the handshake has completed.

An application client that is using a TLS library _without_ callbacks,
and requests a blocking TLS handshake to be performed, will only get to
see the server certificate after the handshake has completed.

While the X.509 cert chain validation might be performed in-band
by the TLS stack, the rfc2818 Section 3.1 server endpoint
identification is left up to the application caller.


-Martin