Re: [kitten] SPAKE and non-deterministic RFC 3961 checksums

["Henry B (Hank) Hotz, CISSP" <[e-mail]>]

> On Sep 27, 2017, at 7:21 PM, Benjamin Kaduk <[e-mail]> wrote:
> 
> On Mon, Sep 25, 2017 at 10:04:15PM -0700, Henry B (Hank) Hotz, CISSP wrote:
>> 
>>> On Sep 25, 2017, at 7:25 PM, Benjamin Kaduk <[e-mail]> wrote:
>>> 
>>> That said, Greg noted on IRC that if we do have a "no DES and SPAKE
>>> together" requirement, the KDC knows the initial reply key and can
>>> do the right thing fairly easiliy, including rejecting optimistic
>>> attempts from (broken) clients.  So, I'm starting to come around to
>>> the camp of "prevent SPAKE with 1DES, and require all future mandatory
>>> checksum types to be deterministic".  (Possibly all future checksum
>>> types entirely, but that may be too aggressive.)
>> 
>> Do we really have that many single-des deployments to worry about anymore? Everything I know of, including AFS and AD/Windows, has better alternatives available and just waiting to be turned on. Surely nobody is still using JGSS in Java 1.4.
> 
> As I understand it, there is not much (any?) modern software that strictly
> requires single-DES, but there are also many sites where the effort to
> upgrade has not been expended.  Even in ATHENA.MIT.EDU, we have cross-realm
> keys that are actively used (albeit not for terribly critical functionality)
> that remain single-DES because of the logistical challenges involved in
> getting both KDC administrators in contact and with a trusted channel.
> 
> -Ben

I know that kind of thing can be much harder than it seems it should. OTOH, do you think that difficulty (as a specific example) should prevent us from stipulating "no 1des with SPAKE”?

Personal email.  [e-mail]