Re: [kitten] New s2k and exposing the strength (iteration count) part of s2kparams

[Jeffrey Hutzelman <[e-mail]>]

On Mon, 2013-12-02 at 15:04 -0600, Nico Williams wrote:
> ISTM that we should:
> 
> 1) Expose the iteration count of the otherwise-opaque s2k params, and
> standardize it, renaming it a strength indication and leaving its
> interpretation as mechanism-specific.  I.e., from now on all new
> enctypes with s2kparams will have theirs start with a four-octet,
> network byte order unsigned measure of strength.

I don't think that's necessary.  The s2k parameters aren't really
opaque; they're enctype-specific and pseudo-opaque at the Kerberos
protocol layer, in the same way that PA-DATA and authorization data are.
IMHO it works better that way, because it means we can carry such things
end-to-end without all of the intermediate pieces having to understand
them.  This has brought us extensibility that otherwise would have been
impossible, and even some that we previously thought _was_ impossible
(e.g. ticket extensions using a magic enctype).

It might be useful for Kerberos libraries, admin tools, and KDC
implementations to include interfaces for managing s2k parameters.
However, I don't think doing so requires that we mandate that future
enctypes use a particular format for s2k parameters, or use a single
linear "strength" parameter.  Future S2K algorithms may have arbitrary
numbers of parameters, and while it may be possible and even desirable
to compute a single "strength indication" from those parameters, the
operation is not likely to be reversible, which means that s2k params
will need to encode the actual individual parameters.


> 2)  It'd be nice if we could add memory-hard s2k functions.  I'm not
> sure what NIST is prepared to consider here.  I guess anything
> provably not weaker than PBKDF2 should be acceptable, but I'm not sure
> how to construct such a thing (XOR of two s2ks is not necessarily
> provably not weaker than either of the s2ks; consider the case where
> they are the same s2k!).
> 
> For a memory- and compute-hard s2k the strength measure might be
> composed of two numbers, one indicating memory strength and the other
> indicating compute strength.

Oh, look; you've just made my point for me. :-)

-- Jeff