Dave Thaler <dtha...@microsoft.com> wrote:
> https://tools.ietf.org/html/draft-thaler-core-redirect-00#section-1 is
> a short summary I wrote last month about this problem.okay, so it just lets one repeat the query over COAPS. With (D)TLS <=1.2, the server still reveals it's certificate identity in the ServerHello to passive observers, and while (D)TLS 1.3 "solves" this for passive observers, it doesn't help with active MITM. Or the attacker can now just initiate DTLS1.3 (but doesn't have to finish it) to find out the identity of the responding server. It seems to me that the real problem is that attackers/observers are not forced to reveal their identity first, in order that respondants can ask, "Who wants to know?" first, and also better repell DDoS. (Attackers would have to have validatable identities to even ask) -- Michael Richardson <mcr+i...@sandelman.ca>, Sandelman Software Works -= IPv6 IoT consulting =-
signature.asc
Description: PGP signature
_______________________________________________ perpass mailing list perpass@ietf.org https://www.ietf.org/mailman/listinfo/perpass
