Re: [kitten] SPAKE and weak checksum types

[Benjamin Kaduk <[e-mail]>]

On Thu, Sep 14, 2017 at 09:38:28PM -0700, Henry B (Hank) Hotz, CISSP wrote:
> 
> > On Sep 13, 2017, at 9:20 PM, Greg Hudson <[e-mail]> wrote:
> > 
> > The particular scenario I was concerned about here (which should not be
> > an issue since we appear to have agreement on the text change) was: the
> > KDC and the client both permit SPAKE and encrypted timestamp.  The KDC
> > decides not to offer SPAKE because the initial reply key is an RC4 key
> > and therefore the transcript checksum would use HMAC-MD5.  The passive
> > attacker can simply dictionary attack the ciphertext from the client (or
> > the KDC).
> 
> Wouldn’t the KDC have already sent a preuth-required message which prohibited that enctype? I thought the list of enctypes was separate from the list of PA types.

The spake draft requires that, if SPAKE is to be used/offered, a single
enctype must be in pa-etype-info2.  So the key decision here is at the
KDC, a combination of whether to offer SPAKE at all and what enctype(s)
to use.  But in this scenario, the KDC does not wholesale forbid HMAC-MD5,
it was just going to comply with the (old) draft text to forbid SPAKE
with MD5.  So, if the RC4 key was the initial choice for reply key,
that "compliant" KDC could not offer SPAKE and would have to only offer
encrypted-timestamp.  The client would then actually send the encrypted
timestamp, offering the ciphertext in question.  On the other hand, if
RC4 was not the initial choice for the reply key, then the KDC would
offer SPAKE with that other enctype.

-Ben