Subject: RE: comments on krb-dns-locate draft

From: "Paul Leach (Exchange)" <[email-masked]>
Date: Mon, 20 Dec 1999 19:02:42 -0800

> -----Original Message-----
> From: Jeffrey Altman [mailto:[email-masked]]
> Sent: Monday, December 20, 1999 6:34 PM
> To: Paul Leach (Exchange)
> Cc: 'Derek Atkins'; Paul Leach (Exchange); Jonathan Trostle; 'Ken
> Hornstein'; [email-masked]
> Subject: RE: comments on krb-dns-locate draft
> 
> 
> > First, one shouldn't confuse TLS/SSL implementations with 
> TLS/SSL. Early
> > versions of SSL in some people's browsers, for example, 
> didn't even examine
> > the server name in the server's certificate.
> 
> I believe that SSL did not require the server name to be checked.

I recall differently, but since it was never an IETF standard, I can't lay
my hands on a copy of the spec.

One can say with confidence, however, that if it didn't, then any claim that
(e.g.) one's credit card was safe when sent over an SSL connection was total
BS.

> This requirement is new to TLSv1.
> 
> > To say any more about your example above, I'd have to know 
> what the Subject
> > DN is in "ted-williams"'s certificate.
> 
> 
>   Certificate[0] subject=/C=US/ST=Massachusetts
>                          /O=Massachusetts Institute of Technology
>                          /OU=NetworkOperations
>                          /CN=ted-williams.mit.edu
>                          /Email=[email-masked]
> 
>   Certificate[0] issuer =/C=US/ST=Massachusetts
>                          /O=Massachusetts Institute of Technology
>                          /OU=MIT Certification Authority

If a client allowed a connection to "www.foo.com" to succeed when the server
presented the above certificate, then said client would be broken. So what
if the connection is encrypted -- the certificate could equally well have
been for "www.mafia.org" who spoofed the DNS and just grabbed your credit
card number.

Paul

---

From: Derek Atkins <[email-masked]>
Date: 21 Dec 1999 11:38:00 -0500

> been for "www.mafia.org" who spoofed the DNS and just grabbed your credit

A client certainly allowed a connection to "ted-williams" to succeed
with the above certficiate.  It's possible the client would have equally
allowed a connection to "ted-williams.mafia.org" who spoofed the DNS,
too.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/      PP-ASEL      N1NWH
       [email-masked]                        PGP key available
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]