Re: [saag] SHA-1 to SHA-n transition

[Eric Rescorla <[e-mail]>]

At Mon, 2 Mar 2009 11:16:47 -0600,
Nicolas Williams wrote:
> 
> On Fri, Feb 27, 2009 at 07:56:12PM +1300, Peter Gutmann wrote:
> > Nicolas Williams <[e-mail]> writes:
> > 
> > >What we need is something like DIGEST-MD5, but tied into browser apps in a
> > >different way than DIGEST-MD5 is today (more on this below).  Given this we
> > >can forego PKI -- just do channel binding to TLS (with or without server
> > >certs, whether CA-issued or self-signed).
> > 
> > We already have this, and have had for some years, it's called TLS-PSK.
> 
> TLS-PSK is not sufficient by itself, and for two reasons:
> 
> a) As the RFC says: "[h]owever, this document is not intended for web
>    password authentication, but rather for other uses of TLS."
> 
>    Thus there is nothing about how to derive PSKs from passwords.

That's because there are already well-known mechanisms for
deriving keys from passwords, as long as you're willing to
live with low entropy. See PKCS#5.


>    Now, we could have PSKs bootstrapped by passwords, but that requires
>    an enrolment protocol, and the result is non-portable credentials
>    (where portable credentials are ones that require no physical devices
>    in order to carry, except, perhaps, pen and paper).

Huh?

At a high level, if what you want is an authentication mechanism
derived form a password, there are only two sets of technical
mechanisms:

- Symmetric-key based systems like TLS-PSK, CRAM-MD5, Digest, etc.
- ZKPP/PAKE systems such as SRP, EKE, etc.

All the protocols in the former class have dictionary attacks on
the password. The protocols in the latter class do not.
TLS-PSK does not explicitly provide for passwords because
we did not want to encourage the use of mechanisms which we
knew were subject to offline dictionary attacks. This is a policy
question, not a technical one. The technical problem is easily
solved by specifying a mechanism to derive a shared key from a
a password (e.g., PBKDF2). The credentials are quite portable.

-Ekr