IETF Logo Mail Archive

Re: [Cfrg] I like PKEX

Richard Barnes <rlb@ipv.sx> Thu, 16 November 2017 07:21 UTC

Return-Path: <rlb@ipv.sx>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A432B12950A for <cfrg@ietfa.amsl.com>; Wed, 15 Nov 2017 23:21:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rPWnXII8urLY for <cfrg@ietfa.amsl.com>; Wed, 15 Nov 2017 23:21:04 -0800 (PST)
Received: from mail-wm0-x235.google.com (mail-wm0-x235.google.com [IPv6:2a00:1450:400c:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 429251293E0 for <cfrg@irtf.org>; Wed, 15 Nov 2017 23:21:04 -0800 (PST)
Received: by mail-wm0-x235.google.com with SMTP id b189so7435076wmd.0 for <cfrg@irtf.org>; Wed, 15 Nov 2017 23:21:04 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=TjCRtcxftXPxp2AkVeol9MFqltblE9Pfe5xvQVaT+1c=; b=GEnnFdI/fzWxcCcCU3Zj8k0CZ7r1VqWM8HpDF1vZh/hQ2b23fJ5rH1c/MpULRMS0b7 1IQKizQnHvmDa9TFAqKn8NuIwc6mmktczed3NAoaBKolXIXHSuIZcgWR6WBuJN/MCxOw qfebJx75e6hV+D6Q+owVxqf9XUW8qeyjh4LpkaenDcaLokLb0nhYT6pB2D0Q7MkgazvW S7J9OqBaz44sCp69N73OIBGZtmMz6IwIGV7BNZ2l1k1I4RybT703Cqp8wisDqetTwSaV ZALj1Cc3AF2J3Q/BlHEiIs9ksz1dUO/v+bozAd7yMrw2cYI9epge3LOHdibOxJ40CXL+ SYmQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=TjCRtcxftXPxp2AkVeol9MFqltblE9Pfe5xvQVaT+1c=; b=o0XWLZxR0KbFRYi2ZpT4YaTjoBujYatwghOwgh+DcD/KXzpphPsU99rxNrpM/AdlRs Bm7KNuCJzizrrwCCTqwv1/P6AYj+HLbMEmwmQURMr7DT91bNNbP81R3gv87bxIKeEi/k Hys/CfD8r1ayb1yxYCYEOLl7Bol5Apl+1tDd3FzkcK3SvXfwJiGLsGl/knSeSD9EDXXA +2c7ayByvbPRIeeTDeqpBJXFsZjnM7loY6EgQi7MY82FctBCncSzTo+PfFa51wrh5m3C oh8hKPsiLQK0mn1UwjIvyuT4W+lfzCCixCCYFEJzgqaWA8wqATA+g9wrnxywMvfECfvE 5EOA==
X-Gm-Message-State: AJaThX6OziepaSBhQ1OXbwQPo7cO6zF6nl2Zjmi/yBB5WT5WCVQGntCA r3CfVLK8UkK0izxd0njawuiwjIKhe54mxE64TxQPeA==
X-Google-Smtp-Source: AGs4zMaQg6L6i4NUOnc0BBUm/Zi60+bzi4XNGDFDoiqHNg2x2AYXugEBUvcT/tbqF1mmVUv3L/vw7varoLzLlsc3Ke4=
X-Received: by 10.28.69.91 with SMTP id s88mr679832wma.19.1510816862609; Wed, 15 Nov 2017 23:21:02 -0800 (PST)
MIME-Version: 1.0
Received: by 10.28.174.81 with HTTP; Wed, 15 Nov 2017 23:21:02 -0800 (PST)
In-Reply-To: <EA0997AC-6EB9-4649-8502-9A185A77760D@akamai.com>
References: <EA0997AC-6EB9-4649-8502-9A185A77760D@akamai.com>
From: Richard Barnes <rlb@ipv.sx>
Date: Thu, 16 Nov 2017 15:21:02 +0800
Message-ID: <CAL02cgT5hAfoga82Opb20C8sB63Hr4bSxssF+N-o=uPtQCoZZA@mail.gmail.com>
To: "Salz, Rich" <rsalz@akamai.com>
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Content-Type: multipart/alternative; boundary="94eb2c0723a66ab935055e1476a7"
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/xH5ukLH37UqDXiMoEldS95TTAR8>
Subject: Re: [Cfrg] I like PKEX
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Nov 2017 07:21:06 -0000

Sorry, what is PKEX?

On Thu, Nov 16, 2017 at 3:11 PM, Salz, Rich <rsalz@akamai.com> wrote:

> I think the PKEX stuff is very interesting.  It inverts the trust model
> used on the Web.   Suppose I want to do some online banking with
> mybank.com. My browser checks the server cert, and decided to trust it if
> the CA verifies the identity. I then type my name and password into the
> website. There is a risk if I end up at the wrong website.
>
>
>
> With PKEX, I can use my name and password and the bank can use something
> like my account number or other similar info, and we exchange and get a
> shared secret. We then use that secret to get an authenticated ECDSA key
> and then I switch to TLS and get its benefits.  No third-party trust is
> needed.
>
>
>
> I think this solves an interesting use-case and it would be nice to have
> it in our toolbox.
>
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>
>

v2.23.0 | Report a Bug | By Email