Re: [Cfrg] [saag] New draft: Hashed Password Exchange

[Yaron Sheffer <[e-mail]>]

Hi Steve,

thanks for the new draft. A few comments:

* The argument against using a random salt is somewhat unconvincing: "it 
would have to be known to the user as well as
the server, and users typically have multiple devices on which they 
enter passwords." Since we assume computing power on the client side, 
there's no reason why we cannot have the server send the salt to the 
user instead of having it stored client-side. I do agree though that the 
benefits of a random salt added to this scheme are minimal.

* Arbitrary non-ASCII passwords must be supported. I suggest to remove 
the under-specified bullet about "canonicalizing the entered password" 
and adopt text similar to (from RFC 6124):

This protocol supports internationalized, non-ASCII passwords.  The 
input password string SHOULD be processed according to the rules of the 
[RFC4013] profile of [RFC3454].  A password SHOULD be considered a 
"stored string" per [RFC3454], and unassigned code points are therefore 
prohibited.  The output is the binary representation of the processed 
UTF-8 [RFC3629] character string.  Prohibited output and unassigned code 
points encountered in SASLprep preprocessing SHOULD cause a 
preprocessing failure and the output SHOULD NOT be used.

* The text implicitly assumes that we are "sending the effective 
password over the wire." This is obviously not the case if strong 
password-based methods of the EKE family are used.

* "If effective passwords are used only for the usual password 
verification and not for cryptographic purposes, they should be treated 
with the care used for ordinary password, i.e., salted, hashed, etc. " I 
can see the value of hashing here, but not of salting.

Thanks,
     Yaron

> >> >>> On 1/4/2012 1:41 PM, Steven Bellovin wrote:
>>>>> >>>>  I'd appreciate comments on my new draft, draft-bellovin-hpw-00.txt:
>>>>> >>>>  
>>>>> >>>>  Abstract
>>>>> >>>>  
>>>>> >>>>      Many systems (e.g., cryptographic protocols relying on symmetric
>>>>> >>>>      cryptography) require that plaintext passwords be stored.  Given how
>>>>> >>>>      often people reuse passwords on different systems, this poses a very
>>>>> >>>>      serious risk if a single machine is compromised.  We propose a scheme
>>>>> >>>>      to derive passwords limited to a single machine from a typed
>>>>> >>>>      password, and explain how a protocol definition can specify this
>>>>> >>>>      scheme.
>>>>> >>>>  
>>>>> >>>>  
>>>>> >>>>  		--Steve Bellovin,https://www.cs.columbia.edu/~smb
>>>>> >>>>  
>>>>> >>>>  
>>>>> >>>>  
>>>>> >>>>  
>>>>> >>>>  
>>>>> >>>>  _______________________________________________
>>>>> >>>>  saag mailing list
>>>>> >>>>  [e-mail]
>>>>> >>>>  https://www.ietf.org/mailman/listinfo/saag
>>>> >>>  
>>> >>  
>>> >>  
>>> >>  		--Steve Bellovin,https://www.cs.columbia.edu/~smb
>>> >>  
>>> >>  
>>> >>  
>>> >>  
>>> >>  
>> >  
> 		--Steve Bellovin,https://www.cs.columbia.edu/~smb
>
>
>
>
>
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag