The context for this question (it's quite involved) can be found in this document: https://docs.google.com/file/d/0B15itpMWb2ztWTJrYTgzX204OVU

However, I want to make it clear that you don't have to read or understand all of that document to answer this question.

Basically, this technique allows the audit of a TLS 1.0/1.1 session without revealing sensitive data (one can effectively choose which html or similar to reveal as part of the audit). However, it's necessary, during the loading of that single resource, that the client does not have possession of the server mac secret (they still have exclusive control of all other secrets - encryption keys and IVs). What potential attacks does that enable?

We should consider an external attacker as well as the 'auditor' (the one holding the server mac key).

  • 2
    $\begingroup$ Depends on the reader maybe, but this question would be hard to answer without reading the source material in my opinion. That's OK though, it's just 6 pages. Peanuts for most of us :) $\endgroup$ – Maarten Bodewes Jun 12 '14 at 23:10
  • 1
    $\begingroup$ owlstead - I think the question stands on its own (what are the possible attacks if you don't check server mac). But I also know some people get curious about the motivation for a question, so it didn't seem to hurt to give a link. If anyone is patient enough to read the whole thing and comment, that is of course appreciated, but I know that's a bit outside the remit of stackexchange. $\endgroup$ – AdamZSI Jun 13 '14 at 7:08
  • $\begingroup$ "what are the possible attacks if you don't check server mac" - of course, the additional question is "and what additional attacks if someone else holds the server mac secret". $\endgroup$ – AdamZSI Jun 13 '14 at 7:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.