Re: [Cfrg] Adoption of draft-ladd-spake2 as a RG document

["Dan Harkins" <[e-mail]>]

On Mon, December 15, 2014 3:16 am, Yoav Nir wrote:
[snip]
> But I would really like to know who needs a PAKE right now. PAKEs require
> the server to store the cleartext password or a password equivalent,
> creating a security issue that is potentially worse than sending cleartext
> passwords through authenticated channels (as in form-based or basic
> authentication to a TLS-protected server)

  Augmented PAKEs do not require a cleartext password. And any
scheme that sent a cleartext password over a TLS connection would
also require "the server to store the cleartext password" so it's not clear
how using a PAKE is "potentially worse".

  The need is illustrated by the fact that the "do not verify server
certificate" or "continue with exchange, I know what I'm doing" check
box exists. In other words, its needed because an authenticated
channel is not a given. Another need can be described by the ever
popular "Use your Facebook credentials to log in", how many people
do you think do? Also, passwords are simple to use and TLS is very
convenient but the world is not all browsers. Furthermore, in the
scheme you are describing there is no guarantee that cleartext
password verification is done on the same box that terminates TLS,
providing another potential for problems.

  Security should be easy to use correctly and hard to use incorrectly.
PAKEs are misuse resistant and they make it hard to use passwords
incorrectly.

  regards,

  Dan.