Re: [kitten] SPAKE and weak checksum types

[Benjamin Kaduk <[e-mail]>]

On Tue, Sep 12, 2017 at 12:47:21PM -0400, Robbie Harwood wrote:
> Greg Hudson <[e-mail]> writes:
> 
> > On 09/11/2017 03:35 PM, Henry B Hotz wrote:
> >
> >> IIUC you are concerned with the case that someone will stand up a kdc
> >> which will opportunistically use SPAKE, but supports older/weaker
> >> stuff. By its nature such a beast will be vulnerable to downgrade
> >> attacks and you can't solve that in SPAKE.
> >
> > If the KDC downgrades itself to encrypted timestamp for DES/RC4 keys,
> > only a passive attack is needed, versus an active attack to downgrade
> > to encrypted timestamp.

I must still be foggy from recovering from being sick; could you walk
me through the passive attack a bit more slowly (or which scenarios are
being compared)?


> > The KDC can't be responsible for preventing downgrades to encrypted
> > timestamp; the client has to refuse it (assuming no FAST or TLS
> > tunneling).
> 
> I think this is the important part for me: we tend to put the
> responsibility on the client to ensure that it receives an adequate
> level of protection.

Yes, this seems like a key point.

> > It will be much easier to configure a client to refuse encrypted
> > timestamp if it doesn't have to worry about the KDC refusing SPAKE
> > based on what enctypes it has for the client long-term key.
> 
> Agreed.

Yup; I think you should go ahead and make this change.  We can (and
are!) work on deprecating weak enctypes independently of new preauth
mechanisms.

-Ben