ADR-008: server-path possession verification — the verifying verifier is the default (OQ-TLS-09 resolved)
Close review 001 §S-1: the default client-cert verifier never checked the client's CertificateVerify, so anyone holding a peer's *public* cert/SPKI bytes (public by design — peers publish them to be dialable) could complete a handshake as that peer, and the auth layer could not detect it. The consumer designs are known (X.509 and raw-key TCP/QUIC endpoints with identity-bearing clients), so implementing now — the zero-consumer moment — avoids the guaranteed breaking republish of flipping the default later. - VerifyPresentedCertVerifier (new): request, don't require, verify possession — permissive verify_client_cert (self-signed chains and bare SPKIs stay valid presentation) + CertificateVerify routing by presented cert kind (Ed25519 SPKI -> verify_tls13_signature_with_ raw_key both TLS versions; X.509 -> standard route), the same routing FingerprintPinVerifier implements. Nine-scheme list verbatim (shared fn, exact-list pin covers both). - Default on every TlsServerConfig path — X509 / RawKey / SelfSigned / ACME (the verifier install is crate-side rustls in new_acme, not rustls-acme's). - AcceptAnyCertVerifier stays public as the explicit no-pop escape hatch, no longer installed by any crate path. - tests/impersonation_posture.rs: four pins — default rejects the attacker (X.509: UnsupportedSignatureAlgorithmForPublicKeyContext; raw-key: BadSignature), escape hatch still accepts + extracts the victim's fingerprint (both cert types). - tests/handshake_behavior.rs: suites 4/4b — possession-checked legit clients (raw-key pin vs raw-key server; X.509 client vs X.509 server) complete and the server extracts the fingerprint; suite 3b doc updated. - Docs: ADR-008 written; OQ-TLS-09 -> resolved (option (b)); ADR-007 §Limits deferral retired to not-planned; server.md/client.md invariants/README/overview synced. Verification: cargo test 81 / --features tcp 95 / --all-features 104 green; clippy -D warnings clean (default + all-features); fmt clean; cargo doc warning-free.
This commit is contained in:
@@ -34,6 +34,7 @@ unresolved.
|
||||
| [005](decisions/005-config-types-move-into-alktls.md) | Accepted | Identity + credentials + fingerprint types move into alktls; auth layer stays out |
|
||||
| [006](decisions/006-module-layout-and-tests.md) | Accepted | Eight-module layout; seed tests + integration invariant pins |
|
||||
| [007](decisions/007-cert-type-negotiation.md) | Accepted | RFC 7250 cert-type negotiation: the offer follows the identity (deviation from alknet; resolves OQ-TLS-10) |
|
||||
| [008](decisions/008-server-path-possession-verification.md) | Accepted | Server-path proof-of-possession: the verifying verifier is the default on every path (resolves OQ-TLS-09) |
|
||||
|
||||
## Lifecycle
|
||||
|
||||
|
||||
+11
-10
@@ -88,15 +88,14 @@ offer from the pin format — an `ed25519:<hex>` pin offers
|
||||
`server_certificate_types = [RawPublicKey]` and completes against a
|
||||
crate-built raw-key server (`raw_key_server_path_completes_with_crate_pin_client`);
|
||||
a `SHA256:<hex>` pin keeps the X.509 offer. A raw-key *client*
|
||||
identity presents its SPKI under the X.509 offer and
|
||||
`AcceptAnyCertVerifier` accepts it end-to-end
|
||||
(`raw_key_client_presents_spki_and_server_extracts_fingerprint`). A
|
||||
pin-format/cert-kind mismatch fails closed at negotiation, never a
|
||||
identity presents its SPKI under the X.509 offer and the server's
|
||||
default verifier possession-verifies it end-to-end
|
||||
(`raw_key_client_presents_spki_and_server_extracts_fingerprint`,
|
||||
`raw_key_client_vs_raw_key_server_default_verifier_checks_possession`).
|
||||
A pin-format/cert-kind mismatch fails closed at negotiation, never a
|
||||
downgrade (`ed25519_pin_against_x509_server_fails_closed_at_negotiation`).
|
||||
Raw-key peers that ride iroh/noq use those transports' own TLS and are
|
||||
unaffected. The strict-server limit (a foreign server demanding
|
||||
raw-only client certs still rejects an X.509-offer presentation) is
|
||||
recorded in ADR-007 §Limits.
|
||||
unaffected.
|
||||
|
||||
## `FingerprintPinVerifier`
|
||||
|
||||
@@ -111,9 +110,11 @@ algorithms; Ed25519 SPKI certs route through
|
||||
`verify_tls13_signature_with_raw_key`): the presenter must prove
|
||||
possession of the corresponding private key, so a stolen or observed
|
||||
certificate cannot be used by a party that does not hold the matching
|
||||
key. This verifier checks proof-of-possession; the server-side
|
||||
`AcceptAnyCertVerifier` does not (see
|
||||
[server.md](server.md), OQ-TLS-09).
|
||||
key. The same possession rule now holds server-side:
|
||||
`VerifyPresentedCertVerifier` is the default client-cert verifier on
|
||||
every server path (ADR-008, OQ-TLS-09); `AcceptAnyCertVerifier`
|
||||
remains the explicit no-pop escape hatch (see
|
||||
[server.md](server.md)).
|
||||
|
||||
The cert-type offer follows the pin format (ADR-007):
|
||||
`requires_raw_public_keys()` returns `true` for `ed25519:` pins
|
||||
|
||||
@@ -127,13 +127,16 @@ recorded rather than silent; this ADR is the record.
|
||||
## Limits (honest scope)
|
||||
|
||||
The SPKI-under-X.509 presentation makes a raw-key *client* presentable
|
||||
to **this crate's** `AcceptAnyCertVerifier` (and to any permissive
|
||||
verifier). A foreign strict RFC 7250 server that *demands*
|
||||
`client_certificate_types = [RawPublicKey]` (`requires_raw_public_keys() == true` server-side) will still reject an X.509-offer
|
||||
presentation. If the rewrite needs that, the additive route is a
|
||||
raw-key-only server-verifier sibling (OQ-TLS-10 option (c)), which
|
||||
pairs with OQ-TLS-09's verify-presenting verifier (option (b)) — both
|
||||
remain additive and are not needed for the crate's own compositions.
|
||||
to **this crate's** server verifiers (both the default
|
||||
`VerifyPresentedCertVerifier` and the `AcceptAnyCertVerifier` escape
|
||||
hatch) and to any permissive verifier. A foreign strict RFC 7250
|
||||
server that *demands* `client_certificate_types = [RawPublicKey]`
|
||||
(`requires_raw_public_keys() == true` server-side) will still reject
|
||||
an X.509-offer presentation. No known alk* deployment needs that (all
|
||||
branch designs use permissive servers — clients may present X.509, an
|
||||
SPKI, or nothing); the additive route if one ever appears is a
|
||||
raw-key-only server-verifier sibling. **Not planned** — recorded here
|
||||
so the next reader doesn't mistake it for pending work.
|
||||
|
||||
## Consequences
|
||||
|
||||
|
||||
@@ -0,0 +1,152 @@
|
||||
---
|
||||
status: accepted
|
||||
last_updated: 2026-09-11
|
||||
---
|
||||
|
||||
# ADR-008: Server-path proof-of-possession — the verifying verifier is the default
|
||||
|
||||
## Status
|
||||
|
||||
Accepted (2026-09-11). Resolves OQ-TLS-09.
|
||||
|
||||
## Context
|
||||
|
||||
Review 001 §S-1 (executed): `AcceptAnyCertVerifier` — then the default
|
||||
client-cert verifier on every `TlsServerConfig` path — never checked
|
||||
the client's CertificateVerify signature. Any party that observes a
|
||||
peer's public cert bytes (X.509) or SPKI (RFC 7250) could complete a
|
||||
handshake *as that peer*: the handshake completed, `peer_certificates()`
|
||||
yielded the victim's cert, and the extracted fingerprint — the
|
||||
identity every downstream auth decision consumes — was the victim's.
|
||||
The auth layer could not detect the spoofing: the fingerprint it was
|
||||
handed *was* the victim's.
|
||||
|
||||
The public cert/SPKI bytes are public **by design** — a peer must
|
||||
publish its identity to be dialable (branch-2 endpoints publish the
|
||||
same Ed25519 public key an SSH server would). So the observed-by-anyone
|
||||
attack surface was every peer identity in the stack, and the only
|
||||
proposed mitigation (challenge-response owned by the auth layer, the
|
||||
rewrite's option (a)) did not exist anywhere in the alk* codebase. The
|
||||
spoil was fully known and the fix fully specified — mirroring the
|
||||
signature routing the client-side `FingerprintPinVerifier` already
|
||||
implements — so "wait for a consumer" (the OQ's deferral framing)
|
||||
repeated the circular reasoning OQ-TLS-10 fell into: the component
|
||||
that must *enable* the consumer was deferring to the consumer it
|
||||
enables. The consumer designs are known (TCP/QUIC servers with X.509
|
||||
or raw-key identities and identity-bearing clients — alkhttp,
|
||||
webtransport, the rewrite's endpoints); possession verification is
|
||||
needed by every one of them that authenticates by fingerprint.
|
||||
|
||||
## Decision
|
||||
|
||||
`VerifyPresentedCertVerifier` is the **default** client-cert verifier
|
||||
on every `TlsServerConfig` path — X509, RawKey, SelfSigned, and ACME
|
||||
alike (the verifier install is crate-side rustls in `new_acme`, not
|
||||
rustls-acme's, so the ACME path flips identically). Its posture:
|
||||
**request, don't require, verify possession.**
|
||||
|
||||
- `offer_client_auth() == true`, `client_auth_mandatory() == false`,
|
||||
`root_hint_subjects() == &[]` — identical request-not-require shape
|
||||
to `AcceptAnyCertVerifier` (no-cert clients unaffected).
|
||||
- `verify_client_cert` accepts any presented bytes — possession is
|
||||
proven by the CertificateVerify, not the cert's provenance;
|
||||
self-signed X.509 chains and bare RFC 7250 SPKIs remain valid
|
||||
presentation.
|
||||
- `verify_tls13_signature` / `verify_tls12_signature` route by
|
||||
presented cert kind: an Ed25519 SPKI goes through
|
||||
`verify_tls13_signature_with_raw_key` (both TLS versions), an X.509
|
||||
chain through the standard `verify_tls{12,13}_signature` — the same
|
||||
routing the client-side `FingerprintPinVerifier` implements, and the
|
||||
same functions rustls' webpki verifiers use.
|
||||
- `supported_verify_schemes()` returns the nine-scheme list verbatim
|
||||
(shared with `AcceptAnyCertVerifier`; the exact-list pin covers
|
||||
both).
|
||||
- `requires_raw_public_keys()` stays `false` — both cert types
|
||||
negotiate (ADR-007).
|
||||
|
||||
`AcceptAnyCertVerifier` stays public as the explicit no-pop escape
|
||||
hatch for a deployment that deliberately wants the old posture
|
||||
(handshake-speed over strictness, an auth layer that owns
|
||||
challenge-response). It is no longer installed by any crate path.
|
||||
|
||||
Mechanism note (rustls 0.23.44, `server/tls13.rs`): when a client
|
||||
presents a cert, rustls calls `verify_client_cert` then
|
||||
`verify_tls13_signature(construct_client_verify_message(..), cert[0],
|
||||
sig)` — the signature covers the transcript hash bound to the
|
||||
`"TLS 1.3, client CertificateVerify"` constant, so the check is a real
|
||||
proof-of-possession of the presented public key, not a replayable
|
||||
blob. A client presenting no cert skips both (the `!mandatory`
|
||||
branch). The attacker's failure mode is a signature under the
|
||||
attacker's key against the victim's public key: `BadSignature`
|
||||
(raw-key) or `UnsupportedSignatureAlgorithmForPublicKeyContext`
|
||||
(X.509 kind mismatch) — pinned by `tests/impersonation_posture.rs`.
|
||||
|
||||
## What this buys — and what it deliberately does not
|
||||
|
||||
**Bought:** the extracted fingerprint is now authenticated as *"the
|
||||
connecting party holds the private key for the presented public
|
||||
identity."* The impersonation attack (victim's public bytes + attacker
|
||||
signer) fails the handshake on every default path, both cert types.
|
||||
This is the S-1 resolution for branches 1 and 2 (X.509 and raw-key
|
||||
TCP/QUIC endpoints with identity-bearing clients).
|
||||
|
||||
**Not bought (deliberately, unchanged):** no CA verification and no
|
||||
name verification — a self-signed chain remains valid presentation,
|
||||
and who a fingerprint maps to (the peer table, scopes, tokens) remains
|
||||
the auth layer's concern (ADR-005). The verifier proves *possession*;
|
||||
the auth layer still decides *trust*. This is exactly the split the
|
||||
crate's scope boundary prescribes (ADR-002).
|
||||
|
||||
## Behavior-preservation invariants under the change
|
||||
|
||||
- The nine-scheme list, request-not-require shape, non-empty root
|
||||
store, 0-RTT, provider, and ALPN handling are untouched.
|
||||
- Fail-closed: unchanged — and the new default adds a rejection where
|
||||
there was silent acceptance (the spoof), the direction that never
|
||||
breaks a legitimate composition.
|
||||
- Legit compositions verified end-to-end (duplex handshakes,
|
||||
`tests/handshake_behavior.rs`): raw-key client pin ↔ raw-key server
|
||||
(suite 4), X.509 client ↔ X.509 server (suite 4b), raw-key client ↔
|
||||
X.509 server (suite 3b) — all extract the client fingerprint under
|
||||
the verifying default. No-cert clients (browsers) unaffected.
|
||||
- QUIC parity: the CertificateVerify mechanism is handshake-level,
|
||||
identical under `for_noq()`.
|
||||
|
||||
## Consequences
|
||||
|
||||
**Positive:**
|
||||
|
||||
- S-1 closed out of the box: no deployment can accidentally run the
|
||||
spoofable posture; the escape hatch must be explicitly installed and
|
||||
its posture is test-pinned.
|
||||
- The auth layer's fingerprint resolution can now treat the fingerprint
|
||||
as a possession-authenticated claim — the option-(c)
|
||||
challenge-response design becomes optional defense-in-depth rather
|
||||
than a prerequisite.
|
||||
- Zero-consumer moment used correctly: flipping the default *after*
|
||||
first consumers would be a guaranteed breaking republish.
|
||||
|
||||
**Negative:**
|
||||
|
||||
- A legitimate client whose signer does not match its presented cert
|
||||
(a misconfigured `CertifiedKey`) now fails the handshake where it
|
||||
previously succeeded silently — the failure is the correct diagnosis
|
||||
(there is no such legitimate composition).
|
||||
- One more public type on the API surface (additive; the freeze allows
|
||||
additions).
|
||||
|
||||
## References
|
||||
|
||||
- OQ-TLS-09 (`docs/architecture/open-questions.md`) — resolved by
|
||||
this ADR
|
||||
- `tests/impersonation_posture.rs` — both postures pinned (default
|
||||
rejects, escape hatch accepts), both cert types
|
||||
- `tests/handshake_behavior.rs` — legit-composition pins (suites 1,
|
||||
3b, 4, 4b)
|
||||
- review 001 §S-1 — the discovery probe
|
||||
- ADR-007 (cert-type negotiation), ADR-002 (scope boundary), ADR-005
|
||||
(auth layer owns peer resolution)
|
||||
- alknet ADR-034 — the request-but-don't-require shape this ADR
|
||||
refines (deviation recorded per AGENTS.md convention 10)
|
||||
- rustls 0.23.44 `server/tls13.rs` (the CertificateVerify flow),
|
||||
`webpki/verify.rs` (`verify_tls13_signature_with_raw_key`)
|
||||
@@ -21,7 +21,7 @@ are authoritative; the Phase 0 doc's statuses are the historical record.
|
||||
| OQ-TLS-06 | ACME task shutdown surface | resolved (detached-only for v1) | low |
|
||||
| OQ-TLS-07 | iroh key surface | **resolved** (ADR-005, byte access pinned) | low |
|
||||
| OQ-TLS-08 | `quinn` → `noq` feature rename | **resolved** (ADR-003) | high |
|
||||
| OQ-TLS-09 | Server-path proof-of-possession | **open** | high |
|
||||
| OQ-TLS-09 | Server-path proof-of-possession | **resolved** (ADR-008) | high |
|
||||
| OQ-TLS-10 | RFC 7250 over TCP: cert-type negotiation gap | **resolved** (ADR-007) | high |
|
||||
|
||||
## Identity & types
|
||||
@@ -112,37 +112,23 @@ are authoritative; the Phase 0 doc's statuses are the historical record.
|
||||
impersonation probe: a handshake with the victim's cert bytes + an
|
||||
attacker signer completes, and the server extracts the victim's
|
||||
fingerprint)
|
||||
- **Status**: open (recorded 2026-09-10)
|
||||
- **Priority**: high
|
||||
- **Question**: `AcceptAnyCertVerifier` never checks the client's
|
||||
CertificateVerify signature — the presented identity is spoofable by
|
||||
anyone holding the public cert/SPKI bytes, and the auth layer cannot
|
||||
detect it (the fingerprint it is handed *is* the victim's). alknet
|
||||
ADR-034 inherited the request-but-don't-require shape without
|
||||
recording this property. Who enforces possession?
|
||||
- **Options**:
|
||||
- **(a) Keep request-but-don't-require; the auth layer owns
|
||||
challenge-response** over the established channel, bound to the
|
||||
presented public key. No crate change; the S-1 doc note on
|
||||
`AcceptAnyCertVerifier` is the honest description until then.
|
||||
- **(b) Add a `VerifyPresentedCertVerifier` sibling**
|
||||
(request-and-verify): same nine-scheme list, permissive
|
||||
`verify_client_cert`, signature methods delegate to
|
||||
`rustls::crypto::verify_tls{12,13}_signature(_with_raw_key)` — the
|
||||
routing the client-side `FingerprintPinVerifier` already
|
||||
implements. Additive; must land before the first consumer (an API
|
||||
shape decision).
|
||||
- **(c) Make the auth layer's fingerprint resolution
|
||||
possession-checked** (a possession proof accompanies each
|
||||
fingerprint resolution). Cross-crate; the auth layer does not exist
|
||||
yet.
|
||||
- **Constraints**: the spoofable posture is pinned by
|
||||
`tests/impersonation_posture.rs` (both cert types) — any decision
|
||||
must fail or update that test together with the
|
||||
`AcceptAnyCertVerifier` doc note.
|
||||
- **Cross-references**: src/server.rs (`AcceptAnyCertVerifier`),
|
||||
src/client.rs (`FingerprintPinVerifier`),
|
||||
docs/reviews/001-implementation-review.md §S-1, alknet ADR-034
|
||||
- **Status**: resolved (2026-09-11) — option (b),
|
||||
[ADR-008](decisions/008-server-path-possession-verification.md).
|
||||
[`VerifyPresentedCertVerifier`](decisions/008-server-path-possession-verification.md)
|
||||
is the default client-cert verifier on every `TlsServerConfig` path
|
||||
(including the ACME path — the verifier install is crate-side
|
||||
rustls, not rustls-acme's): request, don't require, **verify the
|
||||
CertificateVerify against the presented cert's public key**. The
|
||||
extracted fingerprint is possession-checked (attacker-supplied
|
||||
presentations fail the handshake —
|
||||
`tests/impersonation_posture.rs` pins both directions); who a
|
||||
fingerprint maps to remains the auth layer's concern (ADR-005).
|
||||
`AcceptAnyCertVerifier` stays public as the explicit no-pop escape
|
||||
hatch, its posture pinned by the same test file.
|
||||
- **Cross-references**: src/server.rs (`VerifyPresentedCertVerifier`,
|
||||
`AcceptAnyCertVerifier`), src/client.rs (`FingerprintPinVerifier` —
|
||||
the routing being mirrored), ADR-008, review 001 §S-1, alknet
|
||||
ADR-034
|
||||
|
||||
### OQ-TLS-10: How do RFC 7250 raw-key peers negotiate over rustls-driven TCP+TLS?
|
||||
|
||||
@@ -205,6 +191,7 @@ are authoritative; the Phase 0 doc's statuses are the historical record.
|
||||
|
||||
## Deferred / Blocked
|
||||
|
||||
- OQ-TLS-09 (server-path proof-of-possession): open by design — the
|
||||
decision needs the rewrite's auth-layer design in hand (option (c))
|
||||
or an API-shape call before the first consumer (option (b)).
|
||||
None — all recorded OQs are resolved. Future questions (e.g. the
|
||||
raw-key-only server-verifier sibling if a foreign strict RFC 7250
|
||||
server interop ever appears — see ADR-007 §Limits) get new OQ entries
|
||||
rather than reopening these.
|
||||
@@ -79,6 +79,7 @@ All design decisions are documented as ADRs in [decisions/](decisions/).
|
||||
| [005](decisions/005-config-types-move-into-alktls.md) | Config types move into alktls | Identity + credentials + fingerprint move in; auth layer stays out |
|
||||
| [006](decisions/006-module-layout-and-tests.md) | Module layout and test surface | Eight modules; in-module seed tests + integration invariant pins |
|
||||
| [007](decisions/007-cert-type-negotiation.md) | RFC 7250 cert-type negotiation | The cert-type offer follows the identity/pin format — raw-key-over-TCP works (deviation from alknet; resolves OQ-TLS-10) |
|
||||
| [008](decisions/008-server-path-possession-verification.md) | Server-path possession verification | The verifying verifier is the default on every server path; `AcceptAnyCertVerifier` is the explicit escape hatch (resolves OQ-TLS-09) |
|
||||
|
||||
## Open Questions
|
||||
|
||||
|
||||
+42
-39
@@ -59,47 +59,46 @@ test (ADR-006):
|
||||
- **`rustls::crypto::aws_lc_rs::default_provider()`** as the crypto
|
||||
provider on all paths (alknet ADR-084). Never `ring`, never the
|
||||
process-default provider, without a new ADR.
|
||||
- **`AcceptAnyCertVerifier::supported_verify_schemes()`** returns
|
||||
- **The nine-scheme `supported_verify_schemes()`** (shared by
|
||||
`VerifyPresentedCertVerifier` and `AcceptAnyCertVerifier`) returns
|
||||
ED25519 + ECDSA P-256/P-384 + RSA PSS (SHA256/384/512) + RSA PKCS1
|
||||
(SHA256/384/512) — nine schemes, verbatim, pinned by an exact-list
|
||||
integration test.
|
||||
- **The default client-cert verifier verifies possession**
|
||||
(ADR-008): `VerifyPresentedCertVerifier` is installed on every
|
||||
path; the CertificateVerify is checked against the presented
|
||||
cert's public key. `AcceptAnyCertVerifier` exists only as the
|
||||
explicit escape hatch.
|
||||
- **`acme-tls/1` ALPN append** for the ACME path only, done by the
|
||||
crate, not the caller (alknet ADR-027 §7).
|
||||
- **Non-empty root store** — the client CA path merges `webpki-roots`
|
||||
when the platform store is empty (see [client.md](client.md)).
|
||||
|
||||
## `AcceptAnyCertVerifier`
|
||||
## `VerifyPresentedCertVerifier` (the default) and `AcceptAnyCertVerifier` (the escape hatch)
|
||||
|
||||
The server-side client-cert verifier: **request-but-don't-require**.
|
||||
It asks for a client cert (X.509 or RFC 7250 raw key) so the caller
|
||||
can extract the fingerprint via `peer_identity()`, but does not
|
||||
require one and does not verify the presented cert against a CA. The
|
||||
fingerprint is matched against peer records by the auth layer
|
||||
(`IdentityProvider::resolve_from_fingerprint`) *outside* this crate —
|
||||
the TLS crate hands over the fingerprint string; peer resolution is
|
||||
not a TLS concern (ADR-005).
|
||||
The server-side client-cert verifier: **request, don't require, verify
|
||||
possession** (ADR-008, resolving OQ-TLS-09).
|
||||
[`VerifyPresentedCertVerifier`](decisions/008-server-path-possession-verification.md)
|
||||
is the default on every `TlsServerConfig` path (X509 / RawKey /
|
||||
SelfSigned / ACME). It asks for a client cert (X.509 or RFC 7250 raw
|
||||
key) so the caller can extract the fingerprint via `peer_identity()`,
|
||||
does not require one, and does not verify the presented cert against a
|
||||
CA — self-signed chains and bare SPKIs are valid presentation. The
|
||||
client's **CertificateVerify signature is verified** against the
|
||||
presented cert's public key (Ed25519 SPKIs route through
|
||||
`verify_tls13_signature_with_raw_key`; X.509 through the standard
|
||||
route): the extracted fingerprint is possession-checked — presenting a
|
||||
victim's public bytes under an attacker's key fails the handshake.
|
||||
Who the fingerprint maps to remains the auth layer's concern
|
||||
(ADR-005).
|
||||
|
||||
**The presented signature is not verified (no proof-of-possession)** —
|
||||
review 001's S-1: the client's CertificateVerify signature is never
|
||||
checked against the presented cert's public key, so any party holding
|
||||
a peer's public cert bytes (X.509) or SPKI (RFC 7250) can complete a
|
||||
handshake *as that peer*, and the server hands the auth layer the
|
||||
victim's fingerprint. The auth layer cannot detect this — the
|
||||
fingerprint it is handed *is* the victim's. Until the caller enforces
|
||||
possession, treat the extracted fingerprint as an unauthenticated
|
||||
claim, not proof of identity. Two patterns make it safe (the auth
|
||||
layer owns either): challenge-response over the established channel
|
||||
bound to the presented public key, or a verifier that verifies the
|
||||
CertificateVerify (the routing `FingerprintPinVerifier` implements —
|
||||
tracked as OQ-TLS-09; option (b) there is additive but must land
|
||||
before the first consumer). The spoofable posture is pinned by
|
||||
`tests/impersonation_posture.rs` (both cert types) — a change here
|
||||
must fail or update that test together with this doc.
|
||||
|
||||
Server-side only: this must not be reused as a client-side
|
||||
`ServerCertVerifier` — client-side verification is alknet ADR-034's
|
||||
selection matrix (see [client.md](client.md)), and unlike the
|
||||
client-side pin verifier this type has no proof-of-possession check.
|
||||
**The escape hatch**: `AcceptAnyCertVerifier` is the documented no-pop
|
||||
verifier — same request-not-require shape, no CertificateVerify check,
|
||||
so the fingerprint it extracts is attacker-suppliable (S-1). Install
|
||||
it explicitly only when a deployment deliberately wants that posture.
|
||||
Both postures are pinned by `tests/impersonation_posture.rs` (default
|
||||
rejects the attacker, escape hatch accepts — both cert types); a
|
||||
change must update that test together with this doc.
|
||||
|
||||
## `RawKeyCertResolver`
|
||||
|
||||
@@ -117,10 +116,12 @@ sends only when the client verifier overrides
|
||||
(the offer follows the pin format), so a crate pin client completes
|
||||
against this raw-key server
|
||||
(`raw_key_server_path_completes_with_crate_pin_client`). A raw-key
|
||||
*client* identity presents its SPKI under the X.509 offer, which
|
||||
`AcceptAnyCertVerifier` (`requires_raw_public_keys() == false` —
|
||||
correctly; it accepts both cert types) accepts end-to-end
|
||||
(`raw_key_client_presents_spki_and_server_extracts_fingerprint`).
|
||||
*client* identity presents its SPKI under the X.509 offer, which the
|
||||
verifiers (`requires_raw_public_keys() == false` — correctly; both
|
||||
accept X.509-or-raw cert types) accept end-to-end, the default
|
||||
possession-verifying the presentation
|
||||
(`raw_key_client_presents_spki_and_server_extracts_fingerprint`,
|
||||
`raw_key_client_vs_raw_key_server_default_verifier_checks_possession`).
|
||||
Raw-key peers riding iroh/noq are unaffected (their TLS stacks own
|
||||
their negotiation).
|
||||
|
||||
@@ -169,9 +170,10 @@ Lifecycle semantics:
|
||||
filters per endpoint type — alknet ADR-086 §3); the crate appends
|
||||
only `acme-tls/1` on the ACME path.
|
||||
- No handshake: verifier selection and handshake outcomes on the
|
||||
*server* side are `AcceptAnyCertVerifier` + the caller's
|
||||
fingerprint extraction; a rejected handshake is the transport's
|
||||
error, not `TlsError`.
|
||||
*server* side are the default `VerifyPresentedCertVerifier` (or the
|
||||
explicitly-installed escape hatch) + the caller's fingerprint
|
||||
extraction; a rejected handshake is the transport's error, not
|
||||
`TlsError`.
|
||||
- No peer resolution: the extracted fingerprint string goes to the
|
||||
caller; `PeerEntry`/`AuthPolicy` live in the auth layer.
|
||||
|
||||
@@ -183,4 +185,5 @@ Lifecycle semantics:
|
||||
spec this doc mirrors
|
||||
- ADR-001 (invariants), ADR-002 (`TlsError`), ADR-003 (`for_noq`),
|
||||
ADR-004 (accessors), ADR-005 (identity types), ADR-006 (modules,
|
||||
tests)
|
||||
tests), ADR-007 (cert-type negotiation), ADR-008 (possession
|
||||
verification)
|
||||
Reference in New Issue
Block a user