|
Let me address the second part of your question first, and then discuss the benefits of mutual authentication.
Man-in-the-middle attacks are able to defeat one-way SSL authentication because only one party in this transaction is absolutely assured of the other party's identity. Take the following scenario: You (the client) log in to your bank's online website (the server) to pay some bills. If your bank uses one-way SSL, the only party issuing a certificate is the bank's server, which it issues to you. The bank's server is not asking you to issue a certificate authenticating your identity as a legitimate customer. This is the gap. If there is someone listening between you and the bank's server for traffic, they can intercept your request to the server and, unbeknownst to you or the bank, carry on both sides of the conversation.
Let's look at how a man-in-the-middle attack is conducted. The first step is for the bad guy to capture your request to the bank's server, and forward it on your behalf. Next, the bad guy requests a certificate from the bank's server. Once the certificate is received, the attacker will parse out most of the information from the bank's certificate and use it to generate a convincing replica. The last step is to send you, the unsuspecting customer, a certificate that appears authentic. Your browser may issue some vague warnings, but to someone who isn't mindful of the dangerous possibilities of Internet transactions, these warnings are often dismissed by a simple click of the 'OK' button.
Now the bad guy is set up as the man in the middle between you and your bank. He simply sits back and waits for you to input some key pieces of information, such as your user name and password, and he has the keys to the kingdom.
How can this be stopped? One way is by using mutual authentication. The reason the alarming scenario detailed above could work is because the bad guy makes the request on your behalf, and there is no way for the bank to know that it isn't really you. Mutual authentication means that you and the bank are mutually assured of the authenticity of the other's identity. In this transaction, your browser and the bank's server would prove to each other your identity by swapping certificates. Now when you ask for the server's certificate, it would be sure that you were really you, and not the bad guy trying to imitate you.
More information:
|
