Re: [kitten] Comments on draft-ietf-kitten-password-storage-00

[Alexey Melnikov <[e-mail]>]

Hi Sam,

I tend to agree with Ludovic on ordering. More on this below:

On 30/10/2020 00:40, Sam Whited wrote:

> Hi Ludovic,
>
> On Thu, Oct 29, 2020, at 18:48, Ludovic BOCQUET wrote:
>>   * "When using the SASL SCRAM mechanism, the SCRAM-SHA-256-PLUS
>>     variant SHOULD be preferred over the SCRAM-SHA-256 variant, and SHA-
>>     256 variants [RFC7677] SHOULD be preferred over SHA-1 variants
>>     [RFC5802])"
> I disagree with the RFC on this regard, but if further evidence can be
> provided I'm all ears. There are no known pre-image attacks against SHA-
> 1, and the weaknesses I'm aware of at least won't matter for SCRAM since
> SHA-1 is only used in the HMAC so to me it seems preferable to encourage
I think trust in SHA-1 is diminishing, so it will be phased out even if 
HMAC-SHA-1 is still considered to be Ok. I think at this point we 
shouldn't encourage use of SHA-1 with SCRAM, unless this is required for 
backward compatibility reasons.
> channel binding first, and the specific hash second.

That I agree with. So maybe the following ordering:

SCRAM-SHA-256-PLUS
SCRAM-SHA-1-PLUS
SCRAM-SHA-256
SCRAM-SHA-1
?

> That being said,
> channel binding isn't actually very useful right now since there's no
> way to negotiate it and the existing methods are insecure without the
> TLS master secret fix, so maybe it doesn't matter either way.
Fixing channel binding for TLS 1.3 is something that we need to do 
anyway. But this is a separate discussion.
> I am certainly not an expert and will bow to expert opinion if consensus
> is against me, so I'd love more feedback on this.
>
>> In the same time, I think that we must to add two new official SCRAM
>> drafts of the same author of SCRAM:
>>
>> Currently SCRAM-SHA-512-PLUS and SCRAM-SHA-512 are missing:
>> -https://tools.ietf.org/html/draft-melnikov-scram-sha-512
>>
>> Currently SCRAM-SHA3-512-PLUS and SCRAM-SHA3-512 are missing:
>> -https://tools.ietf.org/html/draft-melnikov-scram-sha3-512
> I'm keeping an eye on those and am very excited to see them coming
> along! I'd prefer that they go through expert review first though
> before adding them to this document (although I do think it's
> appropriate to do so since they're both just I-Ds right now, so I don't
> feel strongly about this). I wouldn't want this document to go to RFC
> and still be referencing those I-Ds, but I don't know what the IETF
> position on this is; either way it seems worth waiting and keeping an
> eye on them for now.

Fair point.

Best Regards,

Alexey