Re: [kitten] SPAKE Preauth

[Nathaniel McCallum <[e-mail]>]

On Fri, 2015-05-01 at 16:23 -0500, Nico Williams wrote:
> On Fri, May 01, 2015 at 05:18:58PM -0400, Nathaniel McCallum wrote:
> > On Fri, 2015-05-01 at 16:15 -0500, Nico Williams wrote:
> > > Yes.  And 4.4 makes it worse because continued 2nd factor 
> > > exchanges
> > > use EncryptedData, including from the AS to the client (which can
> > > then confirm that its choice of password guess was incorrect).
> > > 
> > > The fix for this is to send AS->client 2nd factor continuations 
> > > in
> > > the clear if at all possible.  Which means that in the AS->client
> > > 3rd and subsequent passes we need a CHOICE of OCTET STRING or
> > > EncryptedData, or perhaps allow the use of the null enctype in 
> > > the
> > > AS->client 2nd factor EncryptedData.
> > > 
> > > The AS will know as soon as it tries to decrypt the client's 2nd
> > > factor (whose EncryptedData functions as a proof of possession) 
> > > that
> > > the client doesn't know the password.  In this case the AS should
> > > continue and process _a_ 2nd factor as much as possible as if the
> > > password was right.  The AS could do this by arranging to have a
> > > special user account (so as not to lock out the real user) for
> > > testing bogus second factors, and using a random or constant 2nd
> > > factor for this.
> > 
> > I think this is overkill. Most continuations will have already
> > validated some aspect of the second factor. For instance, in 
> > HOTP/TOTP
> > continuations are used for synchronization of the token after the
> > validation of the initial token code.
> 
> It doesn't seem like overkill to me.  Unless the property that an
> attacker can't distinguish which factor was wrong is not that 
> important.
> 
> Note that AS implementations could just always send continuations as
> EncryptedData, leaking that way.  What I want is for it to be 
> possible
> to implement an AS that doesn't leak.

I don't think that is possible. The cost for sending data in the clear
to avoid leaking EncryptedData is the loss of integrity protection.

Nathaniel