Re: [Cfrg] Proposed PAKE Selection Process // Integration in TLS ?

[Benjamin Kaduk <[e-mail]>]

On Wed, Jun 19, 2019 at 11:21:46AM +0200, "Björn Haase" wrote:
> Dear Eric,
> 
> thank you for your feedback! I do agree with and understand your points.
> 
> I am having several questions/remarks which I would like to address in separate threats, starting with the possibly most controversial side-aspects to consider for TLS integration.
> 
> > Eric Crocket wrote:
> >1. We would like to see the standardization of both a standalone scheme and its integration into TLS, similar to SRP (RFCs 2945 and 5054) or OPAQUE
> 
> I fully agree with you and also would also like to see PAKE integrated as a component in TLS. The important aspect to consider, when doing this, IMO will be that we are then integrating components into the TLS stack which today mostly are assigned to the "application layer" (which often should be expected not to consider security adequately). 
> 
> E.g. after a successful TLS-managed login the application on the server will need to know which user is just logged-in, e.g. in order to find out which authorization rights to attribute to the current session.This means that the interface to the TLS system would become somewhat more powerful and complex, by providing interfaces regarding user accounts.

Our experiences with TLS client certificate (re)authentication suggest that
this sort of tight binding between application-layer event and TLS-layer
authentication event is quite difficult to do properly, especially in the
face of HTTP/2 (or /3) and its multiple data streams.

-Ben