On Tue, 20 Aug 2002 04:24, Bram Whillock wrote:
> Just to clarify things here, ssl does establish a secure connection, no
> doubt about that.

As the saying goes, 'ah, yes but', unless you can be sure who you are talking
to over the SSL connection (by being able to verify the certificate chain),
you don't have any kind of 'secure connection'.

Without verification, the encrypted connection can be trivially hi-jacked by
an 'active' man-in-the-middle attacker. Bascially, anyone on the path between
the client and the server (e.g. same LAN, controlling a router or switch or
attached to any network segment you traverse) can pretend to be the server
during the SSL negotiation, then act as a 'transparent proxy' once the
connection is negotiated, passing data onwards to the server (including
re-encrypting using SSL).

(This is not a theoretical attack - try: http://monkey.org/~dugsong/dsniff/
for starters.)

> What we're talking about here is certainty of
> authentication of the remote host. You really can never be 100% certain
> about this authentication because there are any number of ways here that
> the remote host could have been compromised.

Of course, and SSL says nothing about host security - it only protects data
'in transit'. (I cringe each time I see a server claiming 'Secure Site' just
because it uses SSL. How many online stores accept payments over https: then
email the credit card data to some hotmail account? Doh.)

> Without using CA information
> to verify the remote host, you cannot actually verify him because you have
> no root certificates to authenticate his certificates. You could resolve
> the spoofed server problem by checking to see if the only problem with the
> certificates would have been the fact that you can't verify the root
> certificate.

And if you can't verify the root certificate, you might as well stop using
SSL - there's no point. As explained above, users are fooling themselves they
 think that the 'encryption only' still keeps data private from all but a
trivial attacker. :-(

Cris

-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone? Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
Received on 2002-08-20