Re: [secdir] secdir review of draft-kuegler-ipsecme-pace-ikev2

[Nico Williams <[e-mail]>]

On Thu, Apr 14, 2011 at 11:51 AM, Yaron Sheffer <[e-mail]> wrote:
> I'm amazed at the comparison of PACE with SCRAM. In a previous mail you
> pointed out yourself that SCRAM is vulnerable to on-the-wire dictionary
> attacks, which PACE is not. The IETF had never managed to standardize any
> ZKPP methods until just recently (with the exception of TLS-SRP), and
> finally we're doing something about it, even if on the Experimental track. I
> believe this counts as a positive contribution to the security of the
> Internet.

This betrays a fundamental misunderstanding of SCRAM and channel binding.

SCRAM with channel binding to a secure channel is as secure as PACE,
and arguably more so.

If you do not understand what I just wrote then you need to read RFCs
5056, 5929, and 5802 -- in that order.

> I agree that salting the stored password (SPwd) would have improved the
> security of this protocol (unlike iteration counts). And it can be added
> with no extra round trips, since it's not "negotiated", just sent by the
> responder. My coauthor and I need to consider the benefits vs. costs, since
> the major use case here is not open servers, more often it would be VPN
> gateways.

Salting with a username requires no negotiation, but then you can't
rename users without also changing their passwords (a minor issue).

Nico
--