Re: [kitten] taking on new work?

[Benjamin Kaduk <[e-mail]>]

On Tue, Apr 04, 2017 at 11:55:50PM -0500, Benjamin Kaduk wrote:
> 
> What do people currently feel are the top one or two highest
> priority items for the WG to consider?  (Such items need not be
> limited to the above list, of course; note that, e.g.,
> draft-schmaus-kitten-sasl-ht-00 has recently appeared on the list of
> related internet-drafts.)

Taking off my chair hat, I think that
draft-mccallum-kitten-krb-spake-preauth is the most pressing item.
Currently, our claims to security rely on users selecting strong
passwords, which is a laughable assumption given dumps from password
database leaks/etc.  Being able to close off avenues for offline
attacks, which also providing an integrated way to include a second
factor that cannot be attacked separately from the password, seems
like a huge security win.

When I talked to Kenny Paterson about the potential impact of RC4
weaknesses on Kerberos, he said that directly using password-derived
keys is a far bigger problem than the statistical weakenesses of
RC4.

-Ben