Subject: Re: [Unbearable] question about draft-mandyam-tokbin-attest-01

From: Giridhar Mandyam <[email-masked]>
Date: Tue, 4 Apr 2017 22:55:30 +0000

Thank you for your feedback.  This document was not really meant to provide justification for the usefulness of TLS Token binding with respect to MITM - I believe that has already been done in Sec. 7.4 of [1].

Moreover in [2] the author describes TLS vulnerability to MITM due to attacks such as DROWN [3], and how TLS token binding can be used to address the effects of such an attack (e.g. reuse of auth tokens).  

I'll also ask for a clarification from you regarding what you mean by "(modern) TLS".  For instance, do you mean TLS 1.3?  Could this include TLS 1.2 (which allows for NULL cipher suite among other cipher suites with known vulnerabilities)?

-Giri Mandyam

[1] A. Popov et al.  "Token Binding over HTTP."  draft-ietf-tokbind-https-08.  February 16, 2017.  https://tools.ietf.org/html/draft-ietf-tokbind-https-08#section-7.4.
[2] Balfanz, D.  "FIDO Tech Notes:  Channel Binding and FIDO."  https://fidoalliance.org/fido-technotes-channel-binding-and-fido/.  May 23, 2016.
[3] Aviram, N. et al.  "DROWN:  Breaking TLS using SSLv2."  Proceedings of the 25th USENIX Security Symposium.  August 2016.  Available at https://drownattack.com/drown-attack-paper.pdf.

-----Original Message-----
From: Unbearable [mailto:[email-masked]] On Behalf Of Benjamin Kaduk
Sent: Tuesday, March 28, 2017 7:52 PM
To: [email-masked]
Subject: [Unbearable] question about draft-mandyam-tokbin-attest-01

I only quickly looked at this document before the meeting, but had a question about this line in the introduction that "this is useful for prevention of man-in-the-middle attacks on TLS sessions";
(modern) TLS is supposed to prevent man in the middle attacks all on its own, so I don't understand what this is attempting to say.

-Ben

_______________________________________________
Unbearable mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/unbearable