Re: [kitten] SPAKE and weak checksum types

[Robbie Harwood <[e-mail]>]

Greg Hudson <[e-mail]> writes:

> On 09/11/2017 03:35 PM, Henry B Hotz wrote:
>
>> IIUC you are concerned with the case that someone will stand up a kdc
>> which will opportunistically use SPAKE, but supports older/weaker
>> stuff. By its nature such a beast will be vulnerable to downgrade
>> attacks and you can't solve that in SPAKE.
>
> If the KDC downgrades itself to encrypted timestamp for DES/RC4 keys,
> only a passive attack is needed, versus an active attack to downgrade
> to encrypted timestamp.
>
> The KDC can't be responsible for preventing downgrades to encrypted
> timestamp; the client has to refuse it (assuming no FAST or TLS
> tunneling).

I think this is the important part for me: we tend to put the
responsibility on the client to ensure that it receives an adequate
level of protection.

> It will be much easier to configure a client to refuse encrypted
> timestamp if it doesn't have to worry about the KDC refusing SPAKE
> based on what enctypes it has for the client long-term key.

Agreed.

Thanks,
--Robbie