Subject: RE: comments on krb-dns-locate draft

From: Jeffrey Altman <[email-masked]>
Date: Mon, 20 Dec 99 22:10:12 EST

> One can say with confidence, however, that if it didn't, then any claim that
> (e.g.) one's credit card was safe when sent over an SSL connection was total
> BS.

SSLv3 at least supported anonymous ciphers which did not use a
certificate.   The IESG required that the TLSv1 draft be changed so
that it was stated that connections made with anonymous ciphers must
be authenticated by some other means if they are to be used.

> > This requirement is new to TLSv1.
> > 
> > > To say any more about your example above, I'd have to know 
> > what the Subject
> > > DN is in "ted-williams"'s certificate.
> > 
> > 
> >   Certificate[0] subject=/C=US/ST=Massachusetts
> >                          /O=Massachusetts Institute of Technology
> >                          /OU=NetworkOperations
> >                          /CN=ted-williams.mit.edu
> >                          /Email=[email-masked]
> > 
> >   Certificate[0] issuer =/C=US/ST=Massachusetts
> >                          /O=Massachusetts Institute of Technology
> >                          /OU=MIT Certification Authority
> 
> If a client allowed a connection to "www.foo.com" to succeed when the server
> presented the above certificate, then said client would be broken. So what
> if the connection is encrypted -- the certificate could equally well have
> been for "www.mafia.org" who spoofed the DNS and just grabbed your credit
> card number.

IE 5.0 will refuse to accept this certificate if the specified URL is

  https://18.86.0.96/ 

where the IP address is used instead of the FQDN.

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Derek Atkins <[email-masked]>
Date: 21 Dec 1999 11:39:32 -0500

> where the IP address is used instead of the FQDN.

Netscape will fail to accept the above url, too.  But what happens
if you add 'mit.edu' to your DNS search list and then you try:

	https://ted-williams

???

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/      PP-ASEL      N1NWH
       [email-masked]                        PGP key available
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]