2

I am trying to see if there are use cases where a mutually authenticated TLS is preferred over a one way authentication.

Usually the authentication of the client/user is done over the TLS tunnel.

Is a p2p connection a good use case for mutual authentication? In such a scenario each end will somehow prove that they are part of the network. However, in this case the authentication/verification can happen over a one-way authenticated tunnel. What would mandate a mutual auth here?

Are there any other cases I am missing?

2 Answers 2

3

There's a lot of potential benefits to mutual authentication using TLS. Here's a few.

  • You don't need to keep a username/pass database

  • No worry about password reuse.

  • Credentials can be stored on physical tokens/devices.

  • Credentials aren't going to be written on post-it.

  • Users don't have to enter credentials when visiting your resource (certs are automatically used).

  • Less concern about TLS interception proxies as you're authenticating the client.

  • There's little chance of brute forcing a certificate (no worry of password dictionary/brute force)

You would then be reliant on a centralized authority to issue or sign your certificates.

7
  • I would add that user database is still required to map peer certificates against.
    – Crypt32
    Jan 22, 2019 at 20:34
  • I see what you mean, but depending on the use case you might not need a username database. If your only concern is authentication, not authorization (you only care that they are a valid user, not who they are) then a username/profile DB isn't needed.
    – Daisetsu
    Jan 22, 2019 at 20:41
  • you only care that they are a valid user -- this require a users database. How you can tell if presented certificate came from valid user and you have enough information to authenticate them?
    – Crypt32
    Jan 22, 2019 at 21:06
  • If their certificate validates, and has not been revoked.
    – Daisetsu
    Jan 22, 2019 at 21:07
  • 1
    @Crypt32: if you have your own PKI and have full control over the issued client certificates you can just put the username in the certificate. You don't need an additional mapping between certificate and user since the username can be directly extracted from the certificate. Jan 22, 2019 at 22:02
0

Embedded software that automatically connects to a secure server is an example that immediately comes to mind.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .