Re: [http-auth] Why update Digest Auth?

On 2013-07-22 03:14, Stephen Farrell wrote:
[Speculation and counter-speculation removed. As a policy, I never bet a 
beer with an Irishman :-) ]
>>
>> Now my question: we are telling implementors to upgrade Digest to gain
>> I18N (and the algorithm agility, which in this case is mostly security
>> theater, because when using short passwords we remain vulnerable to a
>> dictionary attack anyway). Why not tell them *instead* to move to
>> Digest-v2, which is dictionary attack resistant? Digest-v2 could be
>> based on EKE or SRP, or maybe on draft-oiwa-http-mutualauth, and will
>> support session continuation.
>>
>> Seems to me this would be a much better use of our time, as well as
>> implementors' energy.
>
> Not to me. You can already and should already run over TLS, at which
> point any advantage of ZKPP gets lost in the noise since phishing and
> password verifier DB leakage are entirely unaffected by the elegant
> ZKPP bit fiddling. (That is a shame, since the crypto really is quite
> elegant, but its nonetheless true.)

Everybody running on TLS today uses Basic, and I'd be surprised if we 
started seeing Digest on TLS.

OTOH on insecure transport, ZKPP has a strong advantage, despite the 
database stealing vulnerability. IMHO assuming that non-TLS use will 
simply go away is way too optimistic.

>
> So I'm still of the opinion that minimal modernising of the existing
> schemes plus some experiments is right here and we should not
> pointlessly anoint any of the experiments with standards-track
> status until after we've seen that they are useful in reality.
>
> Having said that, if we decided to abandon work on Digest I'd not
> object.
>
> S.
>
>>
>> Thanks,
>>      Yaron
>> _______________________________________________
>> http-auth mailing list
>> http-auth@ietf.org
>> https://www.ietf.org/mailman/listinfo/http-auth
>>
>>