I have read RFC 5056, RFC 5929, and RFC 5802.

They say channel binding can prevent MITM attacks in an insecure environment where the client does not or cannot verify the authenticity of the server. If I understand correctly, the key idea is utilizing the information(channel bindings) derived from the key exchange of the lower layer security protocol(e.g. TLS) as part of the authentication vector for the upper layer authentication protocol(e.g. SCRAM).

But why that can prevent MITM attacks? An MITM attacker negotiates the lower layer security protocol with both the client and the server, and knows both channel bindings for the client and the server. When the attacker forwards the upper layer authentication messages, he can replace the channel bindings for the client to the channel bindings for the server and then the whole authentication process will succeed.

What am I missing?


1 Answer 1


I got the answer shortly after writing the question.

The channel binding specification assumes the upper layer authentication protocol has an integrity protection mechanism which prevents a MITM attacker to replace channel bindings.

Generally, a challenge and response authentication uses a secure hash and the attacker without knowledge of the shared secret cannot forge a fake response even though he knows channel bindings.

I hope anyone gives a better answer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .