Assurance

[Tom Scavo <>]

On Wed, Mar 12, 2014 at 11:48 AM, Cantor, Scott 
<>
 wrote:
> On 3/12/14, 11:43 AM, "Tom Scavo" 
> <>
>  wrote:
>>
>>I don't understand the client cert use case as well as Duo but I
>>suspect it has the same weakness.
>
> It doesn't. There's no MITM attack with TLS client authentication, unless
> the server is mis-handling data it received prior to authentication and
> attaching it to a later connection from the authenticated client.

I must be missing something. If there's mutual authentication (as
Jacob described earlier), then I see how MiTM is avoided, but how does
ordinary TLS client authentication prevent a MiTM from replaying to
the authentic IdP?

Tom