If I'm right in thinking that mutual auth TLS is one of the more secure forms of TLS (to put it simply), is it reasonable or a good idea to use the cryptographic material sent by Keygen for this purpose?
My threat model is to protect from a Diginotar-style attack. The solution would look like this:
- User logs on to website or creates an account.
- If the machine has never been seen before (new account) instead of adding a persistent cookie, the user is prompted to create a client side certificate.
- The client side cert is signed by the server and imported into the web browser for the purpose of client authentication
- The server registers details of the client certificate (thumbprint / hash / public key) and will use it later for session verification.
- The user logs on to the website (n+1 visit)
- The user is prompted for a client certificate
- The server verifies the client cert.
- Mutual TLS is established.
- The server verifies the authenticated call with a known client certificate. If the calling certificate is blank or from another user, then a MITM may be being performed and access is denied.