jdev - 2023-10-20

https://notes.valdikss.org.ru/jabber.ru-mitm/

Sorry if it was discussed previously ✏

In the operators channel

Should we start verifying SCT in certificates? I wonder how hard it is to add

Firstly, it wouldn't have prevented this attack at all

Secondly, someone involved in CT says "no" :) https://news.ycombinator.com/item?id=37959257

The jabber.ru certificates were requested in plain sight, they were in the CT log and had valid SCTs

Not this attack no, but it could make detecting similar attacks more of a sure thing

Yes, for sure, but it's possible to get valid CA certs without CT/SCT

So, require SCTs? Maybe. But is that really better than, say, pushing forward channel binding?

No, not better. But maybe also good

Especially where we don't have binding, like s2s

True

how does channel binding work ?

very simplified, some stuff is mixed into the authentication exchange that needs to be the same on both sides

if there's a MITM, the stuff will be different, making the authentication attempt fail

the stuff would usually be something related to the TLS connection, either a hash of something or a hash of the certificate

IIRC it's something from the end of a TLS handshake that verifies the whole handshake, and if the client and the server sees the same thing then MITM would be very unlikely

lovetox, https://datatracker.ietf.org/doc/html/rfc5802#section-6 and https://datatracker.ietf.org/doc/html/rfc9266 may be worth reading for details

Thanks zash