Re: [Cfrg] [MASSMAIL]Re: Requirements for PAKE schemes

[Yoav Nir <[e-mail]>]

> On 29 Jan 2016, at 3:22 PM, Robert Moskowitz <[e-mail]> wrote:
> 
> 
> 
> On 01/29/2016 03:04 AM, Василий Долматов wrote:
>> 
>>> 29 янв. 2016 г., в 9:26, Stanislav V. Smyshlyaev <[e-mail] <mailto:[e-mail]>> написал(а):
>>> 
>>> A major number of cryptography failures follows from incorrect embedding of lower-level protocols to high-level ones – if you prove the security of PAKE under specific assumtions on counter handling and then someone implements it without knowledge of them, you have a practical vulnerability. We do not create protocols for vacuum, we make them for practice and must write security considerations (a specific "Security considerations" section in RFC can be used for discussing these issues, if someone thinks that they are not important enough to be in the main part).
>> I think that idea of moving these recommendations and notice about importance of correct setting of these counters to the «Security consideration» section is a good one.
> 
> I agree.  It is the perfect use of "security considerations" for a security technlogy.  None of the old "this whole document is about security".  The security considerations should contain what the risks/threats to the technology is and point out what is done to address/mitigate them.

I’m not sure about that. These considerations are true for any PAKE. In fact, they’re true for any kind of password scheme. You could even make the case that they’re true for any authentication scheme, because letting the opponent keep guessing is at least creating a DoS on the attacked authentication server. 

We generally write in the Security Considerations section stuff that is relevant for that particular scheme, not for a whole class of schemes. So it may be fine to have a BCP document for “Deploying Password Authentication on the Internet”, but I don’t think we need some boilerplate text that goes into the security considerations of any password-related RFC.

Yoav