[CFRG] Re: RGLC on draft-irtf-cfrg-opaque-13

["Riad S. Wahby" <[e-mail]>]

Hello Feng,

"Hao, Feng" <[e-mail]> wrote:
> @Riad, please note that the undetectable online dictionary attack is
> different from the (standard) online dictionary attack. The "completely
> standard attack detection heuristic" applies to the latter only.

This is false. Your "undetectable online dictionary attack" is just a
marketing term that's used to make a minor optimization sound important.

Of course it's detectable, and in exactly the same way that all online
attacks are detectable: the server just counts all authentication attempts
against the rate limit, whether they drop out before completion or not.
As I previously argued, that's the correct behavior no matter which PAKE
you use; it completely dispenses with your "undetectable" attack; and by
the way it is already standard practice.

If there's something to be added to the Security Considerations of OPAQUE
(and indeed, any PAKE document), it's just this: authentication attempts
must be strictly rate limited because passwords are subject to guessing.
That's been the completely standard advice roughly forever, but it doesn't
hurt to remind the reader lest they become confused by silly marketing.

Let's please stop flogging this dead horse. The concern trolling over easily
detected "undetectable" attacks has long since become embarrassing.

-=rsw