Re: [kitten] SPAKE and weak checksum types
Greg Hudson <ghudson@mit.edu> Mon, 11 September 2017 20:38 UTC
Return-Path: <ghudson@mit.edu>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0364132F35 for <kitten@ietfa.amsl.com>; Mon, 11 Sep 2017 13:38:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Level:
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ymYUEsoDc2iT for <kitten@ietfa.amsl.com>; Mon, 11 Sep 2017 13:38:43 -0700 (PDT)
Received: from dmz-mailsec-scanner-8.mit.edu (dmz-mailsec-scanner-8.mit.edu [18.7.68.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 438F7129A89 for <kitten@ietf.org>; Mon, 11 Sep 2017 13:38:43 -0700 (PDT)
X-AuditID: 12074425-c57ff70000004927-84-59b6f4511b1a
Received: from mailhub-auth-3.mit.edu ( [18.9.21.43]) (using TLS with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by dmz-mailsec-scanner-8.mit.edu (Symantec Messaging Gateway) with SMTP id DF.C1.18727.254F6B95; Mon, 11 Sep 2017 16:38:42 -0400 (EDT)
Received: from outgoing.mit.edu (OUTGOING-AUTH-1.MIT.EDU [18.9.28.11]) by mailhub-auth-3.mit.edu (8.13.8/8.9.2) with ESMTP id v8BKcefH016713; Mon, 11 Sep 2017 16:38:41 -0400
Received: from [18.101.8.201] (VPN-18-101-8-201.MIT.EDU [18.101.8.201]) (authenticated bits=0) (User authenticated as ghudson@ATHENA.MIT.EDU) by outgoing.mit.edu (8.13.8/8.12.4) with ESMTP id v8BKccjZ029620 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT); Mon, 11 Sep 2017 16:38:40 -0400
To: Henry B Hotz <hbhotz@oxy.edu>
References: <x7defrdz0le.fsf@equal-rites.mit.edu> <A374D6EA-9C58-4A8B-A68F-1CF9DE20669C@oxy.edu>
Cc: kitten@ietf.org
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <363e60be-b63d-3be4-dfdb-0f085480a98b@mit.edu>
Date: Mon, 11 Sep 2017 16:38:38 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0
MIME-Version: 1.0
In-Reply-To: <A374D6EA-9C58-4A8B-A68F-1CF9DE20669C@oxy.edu>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 7bit
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrJIsWRmVeSWpSXmKPExsUixCmqrRv0ZVukwZ0WLouP9xayWBzdvIrF gcljyZKfTB5bm/4yBzBFcdmkpOZklqUW6dslcGV0vfrOUvCCveJb51nmBsaVbF2MnBwSAiYS N49sYu9i5OIQEljMJHH0+2M2CGcjo8TRfXuYIZyjTBIdp5sYQVqEBYwl9vT/YQexRQQUJRpb joONEhJIkvj64h0ziM0sICyxfM1ZsDibgLLE+v1bWUBsXgEriWWLr4DFWQRUJY4vmQpmiwpE SDzs3MUOUSMocXLmE7B6TgFriSunt7BBzNST2HH9FyuELS+x/e0c5gmMArOQtMxCUjYLSdkC RuZVjLIpuVW6uYmZOcWpybrFyYl5ealFuhZ6uZkleqkppZsYQaHK7qK6g3HOX69DjAIcjEo8 vA292yKFWBPLiitzDzFKcjApifK+O74lUogvKT+lMiOxOCO+qDQntfgQowQHs5IIr8hDoHLe lMTKqtSifJiUNAeLkjivuEZjhJBAemJJanZqakFqEUxWhoNDSYI34TNQo2BRanpqRVpmTglC momDE2Q4D9DwiyA1vMUFibnFmekQ+VOMuhw3Hl7/wyTEkpeflyolzssJUiQAUpRRmgc3B5xi UjlOvmIUB3pLmHcqSBUPMD3BTXoFtIQJaAnPpS0gS0oSEVJSDYzudo59f965nfP2nyC4U15u nsY902//P79ui115aH9089MnBWu59m5WqPmy2YpVcb7nl85au4TZeX6MoXq3hB1Srjv7HQ// segPv8m0Xzcflbe0HnFQcC5P3GWZ/UatMP+rzPy6lpnOYoUsbyQrvryvco269Kjhzc68KT9e uklMvTN51zsfUxklluKMREMt5qLiRABSXWEKDAMAAA==
Archived-At: <https://mailarchive.ietf.org/arch/msg/kitten/e93iNE74Syt2vs7zbGmTNQB8vPw>
Subject: Re: [kitten] SPAKE and weak checksum types
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/kitten/>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 11 Sep 2017 20:38:44 -0000
On 09/11/2017 03:35 PM, Henry B Hotz wrote: > IIUC you are concerned with the case that someone will stand up a kdc which will opportunistically use SPAKE, but supports older/weaker stuff. By its nature such a beast will be vulnerable to downgrade attacks and you can't solve that in SPAKE. If the KDC downgrades itself to encrypted timestamp for DES/RC4 keys, only a passive attack is needed, versus an active attack to downgrade to encrypted timestamp. The KDC can't be responsible for preventing downgrades to encrypted timestamp; the client has to refuse it (assuming no FAST or TLS tunneling). If a client allows it but the KDC does not, the AS request will fail, so the attack will at least be visible, but the client has already sent a ciphertext which can be dictionary attacked. It will be much easier to configure a client to refuse encrypted timestamp if it doesn't have to worry about the KDC refusing SPAKE based on what enctypes it has for the client long-term key.
- [kitten] SPAKE and weak checksum types Greg Hudson
- Re: [kitten] SPAKE and weak checksum types Henry B Hotz
- Re: [kitten] SPAKE and weak checksum types Greg Hudson
- Re: [kitten] SPAKE and weak checksum types Robbie Harwood
- Re: [kitten] SPAKE and weak checksum types Benjamin Kaduk
- Re: [kitten] SPAKE and weak checksum types Greg Hudson
- Re: [kitten] SPAKE and weak checksum types Benjamin Kaduk
- Re: [kitten] SPAKE and weak checksum types Henry B (Hank) Hotz, CISSP
- Re: [kitten] SPAKE and weak checksum types Benjamin Kaduk