Re: [Emu] [saag] Feedback on Salted EAP draft

["Dan Harkins" <[e-mail]>]

  Hi Christian,

On Tue, July 14, 2015 10:50 am, Christian Huitema wrote:
> On Tuesday, July 14, 2015 9:01 AM, Kathleen Moriarty wrote:
>
>> Is there interest in reviewing this draft?  Sam pointed out the
>> importance of moving
>> this work forward, it would be helpful to have volunteers to review the
>> work and also
>> to understand the level of interest (if any) before this goes forward as
>> AD sponsored.
>
> The draft is short and clear enough, but it acknowledges a pretty big
> security issue: "the salted
> password from a compromised database can be used directly to impersonate
> the client-- there
> is no dictionary attack needed to recover the plaintext password."
>
> That's a pretty big caveat, but there are still some advantages over
> operating with unsalted passwords. The draft aligns server side password
> management for EAP-pwd  with standard industry practices, which is good.
> In case of server compromise, the immediate effect of the compromise is an
> attack on the already compromised server, and the per-user salt make
> password discovery harder. The security section should be expanded to
> explain this tradeoff.

  Yea, that is a big caveat. There are existing databases of salted
passwords that cannot be used with RFC 5931 so the motivation for
this draft is to support those currently deployed databases. The
Security Considerations are intended to be as blunt as possible.

> Nits:
>
> - in the abstract, missing "not" in " but did (not?) include support for
> salted passwords."

  Thanks for finding this; I'll fix it in an update.

  regards,

  Dan.

> -- Christian Huitema
>
>
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag
>