Subject: Re: [TLS] Proposal for detecting fraudulent certificates

From: Florian Weimer <[email-masked]>
Date: Sat, 01 Oct 2011 16:16:49 +0000

* Martin Rex:

> Florian Weimer wrote:
>> 
>> * Martin Rex:
>> 
>> > Having the client send _only_ the servers certificate and not the
>> > entire certificate path should IMO be sufficient for the purpose you
>> > outline.
>> 
>> I don't think it is.  The certificate itself is not proof of fraud if an
>> intermediate CA is involved.  More importantly, you cannot tell an
>> intercepting corporate proxy (whose certificate is not rooted in the
>> browser PKI) from a certificate which is.
>
> The Web Server certificate nails down the public&private key for the
> server.  If a MITM has access to the servers private key, then
> you've lost already, because that MITM can perform a perfect
> impersonation for the client (the only thing that the MITM could
> not do is a client-certificate authentication to the real server
> (unless the real server lacks rfc5746 renegotiation protection).

Let me rephrase.  I'm concerned that without the full chain, server
operators dealing with larger user bases will drown in reports of wrong
server certificates, some of them created by Fiddler, some of them by
HTTPS-aware AV-scanning web proxies.  I'm not sure if these cases are
interesting.  The full chain, on the other hand, provides a cryptographi
proof how the server certificate is rooted in the browser PKI.  If it is
properly rooted, but is not yours, you definitely have got a problem.

>> > I don't know why you think the 64 KByte TLS extension size limit would
>> > be a problem.
>> 
>> The wire format allows for larger server chains (up to 16 MB).  This
>> could be abused to bypass detection (just use a certificate with a
>> logotype extension).  I just felt I had to say something about that.
>
> The client could decide to not talk to such TLS servers at all
> (while theoretically not "standards compliant", it is what a
>  non-marginal fraction of the installed base is doing...)

I considered that.  But I don't think we need any more of that.

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99