Re: [Cfrg] 40 bit loop and DragonFly

["Dan Harkins" <[e-mail]>]

On Tue, January 7, 2014 5:47 am, Watson Ladd wrote:
> Try writing up SPAKE2, submit it, and see how long it takes to
> get a good standard through.

  You're the one proposing it, why don't you? In fact, since you have
previously stated it really only takes 30 minutes to write an
interoperable standard why don't you do it during your lunch hour?

> Dragonfly has unfixable flaws relating to its provable security that will
> prevent me from endorsing it for any protocol, ever. I am not alone in
> thinking that we should expect more from the protocols we standardize.
>
> Also, is this implemented in OpenSSL or NSS or PolarSSL? Not yet.

  ZZzzzztt! Wrong. I implemented it in OpenSSL. That's where Appendix
A of draft-ietf-tls-pwd came from. In fact, the sample exchange was
from my EST client talking to my EST server being authenticated with
TLS-pwd.

> Lastly, if this was needed for EST to work, they should have noticed
> this dependency, and tackled it head on. That they punted on
> this problem does not mean it is our responsibility to fix it.

  You use pronouns very loosely. And you exaggerate a bit too much.
Nobody said it was necessary for EST to work. It's needed for EST to
be deployed properly in many situations where there is no trust
anchor database established before the EST exchange is initiated.
There is a chicken-and-egg problem with needing a certificate to
get a certificate. Understand?

  Dan.