Re: [secdir] secdir review of draft-kuegler-ipsecme-pace-ikev2

["Dan Harkins" <[e-mail]>]

  Hi Nico,

On Thu, April 14, 2011 10:25 am, Nico Williams wrote:
> On Thu, Apr 14, 2011 at 12:21 PM, Dan Harkins <[e-mail]> wrote:
>> On Thu, April 14, 2011 9:57 am, Nico Williams wrote:
>>> This betrays a fundamental misunderstanding of SCRAM and channel
>>> binding.
>>>
>>> SCRAM with channel binding to a secure channel is as secure as PACE,
>>> and arguably more so.
>>
>>  PACE does not require a secure channel to be passed through. In fact,
>> the way it's used there is no security (yet), it's just an
>> unauthenticated
>> Diffie-Hellman that "protects" the channel that PACE is done through.
>> PACE performs authentication of the IKE SA by doing a ZKPP and adding
>> the
>> authenticated and shared secret result of the ZKPP into the result of
>> the
>> unauthenticated Diffie-Hellman (plus assorted cruft).
>
> In RFC5056 terms, your "unauthenticated Diffie-Hellman" exchange is a
> "channel".
>
> There seems to be a terminology disconnect.  As a result of this
> disconnect you and others are discarding the work of others (e.g.,
> SCRAM in this case) without understanding it in the first place.

  I don't think there's a terminology disconnect. Yes, it's a "channel",
but the important thing is it's not a "secure channel", which is what
you said above.

  SCRAM is not resistant to off-line dictionary attack, PACE is. So
the work of others has not just been ignorantly discarded, it is just
not appropriate to use in this particular case.

  What is needed here is to parlay a low-entropy password into a
secure secret without anything else. There is no way to "authenticate
the responder with PKIK" (as you implied in another email) because
there is nothing else that could be used in accordance with any PKIK RFC.
Using SCRAM here would be more secure than the broken PSK mode of IKE(v2)
today but would not be resistant to off-line dictionary attack.

  Don't think of this as a username/password protocol. There is no
real "user". There is just a password and the two side have to prove
to each other they know it without leaking any information about it
to each other or an adversary. SCRAM isn't the right tool for this job.

  regards,

  Dan.