Subject: Re: Scale (and the SRV record)

From: [email-masked]
Date: Thu, 5 Nov 1998 10:11:36 -0800

i stated that  i've never seen a SSL session fail the first time a client
sees a server certificate that was manufactored by a CA on the browswer's
CA list ... and you are claiming that is incorrect?

I didn't claim that the URL check didn't exist ... i claimed that I've
never seen it occur.

I also believe that as a factor in exploit it is somewhat nullified in
common practice because majority of SSL sessions are entered with things
like clicking on a buy button. the URL check catches somebody claiming to
being a URL that they aren't (and somehow misrouting traffic).
If it is possible to mis-represent a URL ... prevented by the SSL check ...
then it is also possible to mis-represent the page that (in common
practice) gets you to the SSL session ...
in which case the exploit just has a server certificate that corresponds to
the URL that you are sent to.

---

From: EKR <[email-masked]>
Date: 05 Nov 1998 10:38:15 -0800

> CA list ... and you are claiming that is incorrect?
No, I'm claiming that the following statement is incorrect:
"(the only characteristic for succesful
SSL seems to be that the server's certificate was manufactored by CA known
in the browser list)."

> the URL that you are sent to.
Naturally. However, it's hard to see how to fix this problem
automatically without employing security all the time (which would
protect the references as well), since the issue is typically the
correspondence between the user's expectation of whom he is buying
from (which the program really doesn't have any way of knowing) and
the actual identity of that entity. I'd be interested in hearing
what mechanical check you think would protect against this attack.

Naturally, the user can check the certificate against his expectations,
but that's not automatic.

-Ekr

-- 
[Eric Rescorla                                   [email-masked]]