Re: [secdir] secdir review of draft-kuegler-ipsecme-pace-ikev2

["Dan Harkins" <[e-mail]>]

  Hi Nico,

On Thu, April 14, 2011 9:57 am, Nico Williams wrote:
> On Thu, Apr 14, 2011 at 11:51 AM, Yaron Sheffer <[e-mail]>
> wrote:
>> I'm amazed at the comparison of PACE with SCRAM. In a previous mail you
>> pointed out yourself that SCRAM is vulnerable to on-the-wire dictionary
>> attacks, which PACE is not. The IETF had never managed to standardize
>> any
>> ZKPP methods until just recently (with the exception of TLS-SRP), and
>> finally we're doing something about it, even if on the Experimental
>> track. I
>> believe this counts as a positive contribution to the security of the
>> Internet.
>
> This betrays a fundamental misunderstanding of SCRAM and channel binding.
>
> SCRAM with channel binding to a secure channel is as secure as PACE,
> and arguably more so.

  PACE does not require a secure channel to be passed through. In fact,
the way it's used there is no security (yet), it's just an unauthenticated
Diffie-Hellman that "protects" the channel that PACE is done through.
PACE performs authentication of the IKE SA by doing a ZKPP and adding the
authenticated and shared secret result of the ZKPP into the result of the
unauthenticated Diffie-Hellman (plus assorted cruft).

  regards,

  Dan.