Re: [Unbearable] Possible attack on Token Binding with RSA key exchange

+1  out of scope

encourage using (EC)DHE key exchange in the security consideration ?

Nick Harper <nharper@google.com>于2017年9月2日周六 上午6:11写道：

> I came across an attack on Token Binding today, which I think is worth
> addressing in TBPROTO in some fashion (likely another paragraph in
> Security Considerations). This attack involves an adversary with the
> private key of a server it wishes to impersonate, and was mentioned in
> draft-balfanz-tls-channelid in the last paragraph of its Security
> Considerations.
>
> In brief, if an attacker has possession of a server's private key, it
> can hijack a TLS connection between client and server if the
> connection uses RSA key exchange instead of (EC)DHE key exchange,
> which allows the attacker to exercise the bound token without
> possession of the Token Binding private key.
>
> I realize that we're past WGLC at this point, but I think this should
> be addressed. On one end, we could require forward-secret key exchange
> modes with Token Binding. We could also describe this specific attack
> in the Security Considerations, or we could expand the Security
> Considerations to describe what attacks are and aren't in the Token
> Binding threat model, to say that attacks where the adversary has the
> server's private key are out of scope.
>
> _______________________________________________
> Unbearable mailing list
> Unbearable@ietf.org
> https://www.ietf.org/mailman/listinfo/unbearable
>
-- 
致礼  Best Regards

潘蓝兰  Pan Lanlan