Subject: RE: [Isms] Rough Consensus Declaration: ISMS Architecture is EK

From: "McDonald, Ira" <[email-masked]>
Date: Thu, 5 May 2005 17:21:26 -0700

Hi,

It's failing because of the man-in-the-middle attacks with
freely available hacker tools.  If the authenticated security
identities of both parties are not bound into the same protocol
layer, then man-in-the-middle attacks are easy.  

This has been noted in the past on the ISMS WG mailing list, 
but I wanted to remind people again not to make this mistake.
This is specifically why using HTTP Digest for client auth after
doing server auth at the TLS layer is inherently unsafe (as I'm
sure you know).

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Blue Roof Music / High North Inc
PO Box 221  Grand Marais, MI  49839
phone: +1-906-494-2434
email: [email-masked]

> -----Original Message-----
> From: Sam Hartman [mailto:[email-masked]]
> Sent: Thursday, May 05, 2005 7:37 PM
> To: McDonald, Ira
> Cc: 'Ken Hornstein'; [email-masked]
> Subject: Re: [Isms] Rough Consensus Declaration: ISMS 
> Architecture is EK
> 
> 
> >>>>> "McDonald," == McDonald, Ira <[email-masked]> writes:
> 
>     McDonald,> I'd like to remind folks that assymetrical
>     McDonald,> authentication (server-side via TLS, client-side via
>     McDonald,> some 'higher' layer) has been and is failing every day
>     McDonald,> in the real world.
> 
> How is it failing?
> 

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Sam Hartman <[email-masked]>
Date: Thu, 05 May 2005 20:31:18 -0400

>>>>> "McDonald," == McDonald, Ira <[email-masked]> writes:

    McDonald,> Hi, It's failing because of the man-in-the-middle
    McDonald,> attacks with freely available hacker tools.  If the
    McDonald,> authenticated security identities of both parties are
    McDonald,> not bound into the same protocol layer, then
    McDonald,> man-in-the-middle attacks are easy.

    McDonald,> This has been noted in the past on the ISMS WG mailing
    McDonald,> list, but I wanted to remind people again not to make
    McDonald,> this mistake.  This is specifically why using HTTP
    McDonald,> Digest for client auth after doing server auth at the
    McDonald,> TLS layer is inherently unsafe (as I'm sure you know).

So, I really hate to be defending this practice as I'm normally the
one who is decrying the practice of not binding authentication.
However SASL doesn't currently provide a way of binding authentication
to TLS.  So if we support SASL, then we are vulnerable to this issue.

Note that it is not actually a problem if you verify TLS certificates.
So it's not so much that you are vulnerable to a man-in-the-middle
attack as that you need to deploy a different authentication
infrastructure for client to server than for server to client.  If
both of these infrastructures work ande are correctly configured then
things are secure.

At one level I think that is a bad design and hope not to repeat the
mistake in future protocols.  To the extent that it is reasonable to
do I'll make sure that ISMS does not make this mistake.

At another level, though, many people do want the combination of SASL
and TLS.  It is sometimes a bigger mistake to prevent people from
using their deployed infrastructure.