Re: [secdir] secdir review of draft-kuegler-ipsecme-pace-ikev2

[Yaron Sheffer <[e-mail]>]

I am unfamiliar with SCRAM, and never claimed otherwise. I just quoted 
your own analysis during the ipsec ML discussion. *Still* not having 
read the documents, I'd like to remind you that any auth protocol over 
IKE is vulnerable to passive attackers until authentication is complete, 
channel binding or not.

We can apply random salt, not just salt with the user name, because the 
PACE "action" only starts at the *second* exchange of IKEv2. So we can 
piggyback a salt payload along with the Responder's notification that it 
supports the protocol.

Thanks,
	Yaron

On 04/14/2011 07:57 PM, Nico Williams wrote:
> On Thu, Apr 14, 2011 at 11:51 AM, Yaron Sheffer<[e-mail]>  wrote:
>> I'm amazed at the comparison of PACE with SCRAM. In a previous mail you
>> pointed out yourself that SCRAM is vulnerable to on-the-wire dictionary
>> attacks, which PACE is not. The IETF had never managed to standardize any
>> ZKPP methods until just recently (with the exception of TLS-SRP), and
>> finally we're doing something about it, even if on the Experimental track. I
>> believe this counts as a positive contribution to the security of the
>> Internet.
>
> This betrays a fundamental misunderstanding of SCRAM and channel binding.
>
> SCRAM with channel binding to a secure channel is as secure as PACE,
> and arguably more so.
>
> If you do not understand what I just wrote then you need to read RFCs
> 5056, 5929, and 5802 -- in that order.
>
>> I agree that salting the stored password (SPwd) would have improved the
>> security of this protocol (unlike iteration counts). And it can be added
>> with no extra round trips, since it's not "negotiated", just sent by the
>> responder. My coauthor and I need to consider the benefits vs. costs, since
>> the major use case here is not open servers, more often it would be VPN
>> gateways.
>
> Salting with a username requires no negotiation, but then you can't
> rename users without also changing their passwords (a minor issue).
>
> Nico
> --