SSL - Different procedures to authenticate Server and Client

From: Paulo Wilbert (pwilbert_at_uninet.com.br)
Date: 09/10/04

  • Next message: Teo Gomez: "RE: Password Cracking" 
    Date: 10 Sep 2004 00:27:20 -0000
To: security-basics@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Hi Folks,

    Why in SSL the procedure to authenticate the Client (see
    below) is not the same to authenticate the Server (see
    below)?

    Client Authentication: "Does the user's public key
    validate the user's digital signature? The server checks
    whether the user's digital signature can be validated with
    the public key in the certificate. If so, the server has
    established that the public key asserted to belong to the
    user matches the private key that is used to create the
    signature and that the data has not been tampered with
    since it was signed"

    Server Authentication: "Does the domain name in the
    server's certificate match the domain name of the server
    itself? This step confirms that the server is actually
    located at the same network address that is specified by
    the domain name in the server certificate. Although step 4
    is not technically part of the SSL protocol, it provides
    the only protection against a form of security attack
    known as a "Man-in-the-Middle Attack." Clients must
    perform this step and must refuse to authenticate the
    server or establish a connection if the domain names do
    not match. If the server's actual domain name matches the
    domain name in the server certificate, the client goes on
    to step 5."

    Thanks,

    Paulo.

    ---------------------------------------------------------------------------
    Computer Forensics Training at the InfoSec Institute. All of our class sizes
    are guaranteed to be 12 students or less to facilitate one-on-one
    interaction with one of our expert instructors. Gain the in-demand skills of
    a certified computer examiner, learn to recover trace data left behind by
    fraud, theft, and cybercrime perpetrators. Discover the source of computer
    crime and abuse so that it never happens again.

    http://www.infosecinstitute.com/courses/computer_forensics_training.html
    ----------------------------------------------------------------------------

  • Next message: Teo Gomez: "RE: Password Cracking"

    Relevant Pages

    • Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
      ... SSL only validates you are talking to a SSL certified server; ... They can simply edit the URL the client program ... can be done by using a X.509 certificate on both ends, ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: LDP client authentication fails
      ... I got the LDP working with LDAP server under server client authentication ... I did not installed the certificate in pfx format .. ... Client cert auth won't work without that. ...
      (microsoft.public.windows.server.active_directory)
    • Re: SSL & Man In the Middle Attack
      ... >> it possible for the middle man to intercept all messages from server to me ... > server sends client a signed message along with a digital certificate. ... > client generates a random secret key, ...
      (comp.security.misc)
    • Re: activesync issue
      ... On the SBS 2003 Server open the Server Management console. ... On the "Web Server Certificate" page, choose to create a new Web server ... Install the new certificate which created in above step on mobile device: ... Access to browse the Exchange Server 2003 client after you install ...
      (microsoft.public.windows.server.sbs)
    • [Full-disclosure] VMSA-2006-0010 - SSL sessions not authenticated by VC Clients
      ... X.509 certificate when creating an SSL session, ... Both the client and server need certificates from a mutually-trusted ... VirtualCenter 2.0.1 Patch 1 and VirtualCenter 1.4.1 Patch ...
      (Full-Disclosure)
    Loading