Subject: Re: [TLS] Inclusion of OCB mode in TLS 1.3

From: Peter Gutmann <[email-masked]>
Date: Sun, 25 Jan 2015 04:05:09 +0000

Aaron Zauner <[email-masked]> writes:

>That's a nice trick but as you point out pretty useless in terms of a PKI.

It's done solely to deal with browsers, which demand to see a certificate when
they're connecting to something via TLS.

(Aside: You can see why some people think the CA/Browser forum as a conspiracy
 to force the use of certs, despite there being very good alternatives
 available browsers force you to use certificates whether they're appropriate
 or not).

More generally, PKI is pretty much useless for many SCADA situations.  Take
for example IEDs, the unfortunately-named Intelligent Electronic Devices used
in the power industry.  These talk something like GOOSE/GSSE or MMS running
over DNP3 or switched Ethernet, or maybe Modbus, for which PKI makes no sense
whatsoever (both because the way things are identified don't work with
certificates, and because the concept of doing cert-provisioning and
revocation checking and whatnot in an IED like an on-load tap changer
controller is just bizarre).

What I've seen so far (and things are in a state of change at the moment
because there are standards that say you have to use TLS with certificates and
whatnot and the industry is realising that while it's fine to say that in a
spec, it doesn't work in practice) is a management interface using hardwired
certs (the memcpy()-a-blob system) and then the control interfaces using PSK
or who knows what else (there are vast numbers of protocols used, it's a
headache to untangle them).

Peter.

---

From: Roland Zink <[email-masked]>
Date: Mon, 26 Jan 2015 10:43:33 +0100

>   available browsers force you to use certificates whether they're appropriate
You probably need to blame IETF for this, for example RFC2818 (HTTP Over 
TLS) states:

      3.1 <http://tools.ietf.org/html/rfc2818#section-3.1>. Server Identity

In general, HTTP/TLS requests are generated by dereferencing a URI. As a 
consequence, the hostname for the server is known to the client. If the 
hostname is available, the client MUST check it against the server's 
identity as presented in the server's Certificate message, in order to 
prevent man-in-the-middle attacks.

Regards,
Roland