Re: Servers that just want to have TLS

On Fri, 9 May 1997, Donal Arundel wrote:

> 
> 
> At 17:52 08/05/97 -0300, E. Gerck wrote:
> >Yes, but public does not mean it should be left open for mitm and other
> >attacks.
> >
> >You don't need authentication to encrypt. You are just guaranteeing a
> >private and secure channel.
> >
> >I think that LDAP could most surely benefit from that, specially in
> >situations like blind signatures.
> 
> Yes, but encryption without authentication doesn't actually guarantee
> you a private channel. It just gives you a private channel to an 
> unauthenticated endpoint and thus is subject to a man in the middle 
> attack. The mitm can just listen and pass data to and from the 
> intended recipient.
> 

No, you are mixing up concepts. I don't know if this is the right forum
to discuss this, but I will elaborate.

As I said, encryption guarantees you a private and secure channel with an
anonymous user, which is much better than no encryption with an anonymous
user, which was the situation I was replying to (but you snipped off) !

Better, it can avoid mitm -- yes -- (which the other situation can't, of
course), even without user authentication, if the anonymous user knows for
sure a quality of the LDAP server -- which can be public. 

It is a common misconception to think that you need two authenticated
endpoints to avoid mitm.

Better still, it can avoid mitm also if the user does not know for sure a
quality of the server but can use multiple communication channels to
access the server, with an estimate that above three channels the
probability of a mitm attack can be almost zero.

It is a much more common misconception to think that you need at least one
authenticated endpoint to avoid mitm.

As I said, it could be very useful for LDAP, specially with blind
signatures.

Yours,

Ed Gerck

______________________________________________________________________
Dr.rer.nat. E. Gerck                        [email protected]
http://novaware.cps.softex.br
P.O.Box 1201, CEP13001-970, Campinas-SP, Brazil  - Fax: +55-19-2429533