Subject: Which Subject name type is more secure

From: "Mohammad Awad" <[email-masked]>
Date: Sun, 16 Mar 2003 09:44:46 +0200

Hi All,
I've a question regarding the usage of the X.509 certificate. What is 
considered more secure against the identity stealing threat, to have the 
alternate subject name of the certificate registering the IP address of the 
entity, or the FQDN name? I.e., which of those two (IP, FQDN) result in more 
dangerous security breach for when an attacker could steal them.
My understanding is that whenever the attacker intend to steal a victim's IP 
address, it never can exploit this incident by any gain beyond DoS, because 
conceptually the attacker could never receive the packets targeted to the 
stolen IP address. On the other hand, by spoofing the DNS system, the 
attacker is able to impersonate the victim's FQDN in both sending and 
receiving packets, so can perform a real security breach.
Could any body kindly provide me with corrections for my understanding.
Thank you all.
Moham. Awad.

_________________________________________________________________
Help STOP SPAM with the new MSN 8 and get 2 months FREE*  
http://join.msn.com/?page=features/junkmail

---

From: Stephen Kent <[email-masked]>
Date: Tue, 18 Mar 2003 11:50:22 -0500

At 9:44 AM +0200 3/16/03, Mohammad Awad wrote:
>Hi All,
>I've a question regarding the usage of the X.509 certificate. What 
>is considered more secure against the identity stealing threat, to 
>have the alternate subject name of the certificate registering the 
>IP address of the entity, or the FQDN name? I.e., which of those two 
>(IP, FQDN) result in more dangerous security breach for when an 
>attacker could steal them.
>My understanding is that whenever the attacker intend to steal a 
>victim's IP address, it never can exploit this incident by any gain 
>beyond DoS, because conceptually the attacker could never receive 
>the packets targeted to the stolen IP address. On the other hand, by 
>spoofing the DNS system, the attacker is able to impersonate the 
>victim's FQDN in both sending and receiving packets, so can perform 
>a real security breach.

I'm afraid this is not a well-formed question, as it does not state 
all of the context in which the certs are used.

Putting an address in a cert is useful if the CA is authoritative for 
address space assignments, but not necessarily a great idea 
otherwise. The same might be said about putting in a DNS name. We 
usually employ DNS names as the means of identifying machines, so if 
a cert as both the DNS name and address, it provide protection 
against DNS attacks, but it faces the problem that an address change 
necessitates will result in revocation and reissuance of the cert. If 
one puts only the DNS name in the cert, and then uses the key in the 
cert to authenticate the machine, then a DNS attack will not succeed. 
However, if one puts in only the IP address, then a DNS attack could 
cause the wrong address to be returned in response to the 
name-to-address mapping, and a valid cert for the "wrong" address 
would not provide the security the user probably envisioned.

I hope this example shows how hard it is to respond to the question you posed.

Steve