Say that there are two servers that perform TLS. Both servers have valid end-point certificates. In other words, neither of them would raise a warning from the browsers after the connection has been established.
Is there any way that the client authentication requested by one server can be abused to create a valid connection to the other server? For TLS 1.2 the final authentication is performed using the
Finished message containing
verify_data which is calculated over all the handshake messages. Is this enough to prevent a man-in-the-middle attack even if there is a trusted malicious server in play? What about the former TLS 1.1, 1.0 and SSLv3 protocols?
One of the two servers can be considered to be malicious. The malicious server may use the same web-address with a valid client certificate from a different chain and private key. Any cipher suite is valid although ones that are commonly enabled in browsers have of course preference to an attacker. I don't think it matters much, but assume that the client authentication is performed using X509v3 certificates using PKCS#1 v1.5 padding with SHA-256 as signature algorithm.