20.8 Triple Handshake attack
In the Triple Handshake attack [29], an attacker posing as a man-in-the-middle causes two separate TLS connections, namely one from client Bob to attacker Mallory and another from attacker Mallory to server Alice, to share the same PreMasterSecret (PMS) and the same sessionID. In two subsequent handshakes, client authentication is broken by Mallory because application layer data sent by Mallory is accepted as authentic messages coming from Bob by Alice. In this respect, the Triple Handshake attack is similar to insecure renegotiation. In this case, however, the client authentication (via signatures and certificates) within TLS is attacked, while insecure renegotiation targets higher-layer authentication mechanisms such as username/password.
20.8.1 The attack
In the first handshake (shown in Figure 20.6), the TLS 1.2 client Bob deliberately connects to a server run by Mallory, not knowing that Mallory is malicious. Having received Bob’s clientHello...
