Re: [kitten] SPAKE Preauth

[Nico Williams <[e-mail]>]

In addition to adding some standard OTP-ish second factors, I'd like to
have a way to "augment" the PAKE with the same user password so as to
improve resistance to KDC database compromise.

For example, if we had a password->signature key algorithm then we could
have a second factor that consists of a signature of the AS' and user's
PAKE public keys (say; handwaving a bit)m and then the AS ends up
storing w (from the PAKE) and the public key for the signature.

If we salt the password differently to derive w and the siging key, then
the AS ends up storing not a password equivalent, but a password
verifier.  That makes KDB compromise somewhat less bad than today, since
attackers would have to mount off-line dictionary attacks, giving realm
operators more time to have users change their passwords.  (Service keys
remain a problem, but that can be addressed too, separately.)

But augmenting the PAKE this way means we may need to use two second
factors: one to augment the PAKE, and one that's the actual OTP-ish
second factor.  That will require some tweaking of the proposed
protocol.

Nico
--