Re: [secdir] secdir review of draft-kuegler-ipsecme-pace-ikev2

["Dan Harkins" <[e-mail]>]

  Hi Nico,

  One other thing...

On Thu, April 14, 2011 9:57 am, Nico Williams wrote:
> On Thu, Apr 14, 2011 at 11:51 AM, Yaron Sheffer <[e-mail]>
> wrote:
>> I agree that salting the stored password (SPwd) would have improved the
>> security of this protocol (unlike iteration counts). And it can be added
>> with no extra round trips, since it's not "negotiated", just sent by the
>> responder. My coauthor and I need to consider the benefits vs. costs,
>> since
>> the major use case here is not open servers, more often it would be VPN
>> gateways.
>
> Salting with a username requires no negotiation, but then you can't
> rename users without also changing their passwords (a minor issue).

  I'm not sure that salting really buys anything. This is not a client-
server protocol; either side can initiate to each other. So both sides
need an _identical_ representation of the credential to authenticate with.
If there is some agreed-upon salt then the salted password becomes
the credential to use. This is no different than just using an unsalted
password. The nonces from the IKE exchange are used in PACE to provide
additional randomness to its particular use of the password.

  regards,

  Dan.