作者
Nadarajah Asokan, Valtteri Niemi, Kaisa Nyberg
发表日期
2003/4/2
图书
International Workshop on Security Protocols
页码范围
28-41
出版商
Springer Berlin Heidelberg
简介
Deploying a new security protocol is expensive. This encourages system designers to look for ways of re-using existing infrastructure. When security protocols and components are re-used, it is critical to re-examine the security of the resulting system as a whole. For example, it has become a standard paradigm to run a legacy client authentication protocol within a secure tunnel. The commonest example of such composition is the use of HTTP authentication inside a TLS tunnel.
In this paper, we describe a man-in-the-middle attack on such protocol composition. The vulnerability arises if the legacy client authentication protocol is used both in tunnelled and untunnelled forms. Even when the client authentication protocol and the tunnel protocol are both secure, composing them in the customary manner results in an insecure system.
We propose a solution to this problem by using a cryptographic …
引用总数
学术搜索中的文章
N Asokan, V Niemi, K Nyberg - International Workshop on Security Protocols, 2003
N Asokan, V Niemi
A Nadarajah, V Niemi, K Nyberg - International Workshop on Security Protocols Springer …, 2003