Executive Summary

This vulnerability involves TLS 1.3 post-handshake authentication (PHA) where a server could incorrectly accept a client's Finished message without the client having sent a Certificate and CertificateVerify messages. The issue arises because the exemption that allows an empty or absent peer certificate was intended only for the initial handshake, but it was mistakenly applied during a post-handshake CertificateRequest as well.

The fix scopes this exemption to the initial handshake only. After a post-handshake CertificateRequest has been sent, the server requires a peer certificate and a valid CertificateVerify before accepting the Finished message. This vulnerability only affects TLS 1.3 servers built with post-handshake authentication support that enable specific verification modes and request client certificates after the handshake.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow a client to bypass proper client certificate verification during post-handshake authentication, potentially enabling unauthorized access or impersonation. Since the server might accept a Finished message without verifying the client's certificate, it could undermine the authentication process and reduce the security guarantees of TLS 1.3 connections.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that your TLS 1.3 server is not built with post-handshake authentication support enabled unless necessary.

Specifically, avoid enabling WOLFSSL_POST_HANDSHAKE_AUTH or the --enable-postauth option, and do not enable WOLFSSL_VERIFY_POST_HANDSHAKE if you request client certificates after the handshake.

If post-handshake authentication is required, ensure that the server enforces that a peer certificate and a valid CertificateVerify message are received before accepting the client's Finished message during post-handshake authentication.

Useful 0 Not Useful 0