Re: [saag] SHA-1 to SHA-n transition

[Eric Rescorla <[e-mail]>]

At Mon, 2 Mar 2009 10:11:35 -0600,
Nicolas Williams wrote:
> 
> On Thu, Feb 26, 2009 at 06:23:59PM -0800, Eric Rescorla wrote:
> > I don't want to get into an extensive argument about this on SAAG,
> > but I don't think this direction is particularly promising, for
> > reasons I've indicated before: namely that you're handwaving
> > the difficult part of the problem, UI, which we have no real 
> > idea how to solve. Sure, if we solved that, there are any
> > number of things we could do, but absent that, the other things
> > are fairly useless.
> 
> I'm not entirely handwaving the UI part.  There are two major UI
> problems: a) the desire for full-screen apps, and, more generally, apps
> that have full access to human interface I/O, b) the desire of web
> application developers to have full control over credentials prompts.
> 
> (a) is practically insurmountable -- SAS helps, but I doubt users will
> be happy to use SAS every time they are prompted for credentials.  My
> knee-jerk reaction would be to reject full-screen apps.
> 
> In my scheme (b) is solved by letting apps prompt for identities,
> but not any passwords -- and training users not to enter passwords into
> non-secure dialogs (see SAS comment) -- and by having authentication
> mechanisms where the relying party does not get to impersonate the
> client just because the client authenticated itself (this, in turn,
> creates another problem in that lots of web services need delegation).
> 
> In particular I think the solution to (b) needs to go hand-in-hand with
> any solution to the mutual authentication problem.

I would characterize this as handwaving. 

As long as the user's credential provided to their client is a human
readable password (and I think that's pretty clearly an invariant in a
large number of cases), then you have to worry about the user being
conned into typing their password into a dialog box controlled by the
attacker. Seeing as the available evidence suggests that there is
almost no UI chrome that can stop them from doing so, even when the
attacker only controls the ordinary browser interface.

Sure, you can imagine training users not to do that, but since
there's no evidence that you can in fact do so, that seems fairly
speculative.

-Ekr

P.S. I don't see how SAS is at all relevant here. SAS depends on the existence
of a trusted channel to carry the SAS, and that's precisely what we don't
have.