[lamps] draft-ietf-lamps-lightweight-cmp-profile-05 concern

[Nick Lamb <[e-mail]>]

Hi

I am not a LAMPS working group member, but I watched a video of the
presentation of this ID at IETF 110 on Youtube.

I noted with concern that the presenter suggests TLS 1.3's PSK modes
are suitable for use with a password.

This is _explicitly_ not the case. To quote RFC 8446:

"Deriving a shared secret from a password or other low-entropy
sources is not secure.  A low-entropy secret, or password, is subject
to dictionary attacks based on the PSK binder.  The specified PSK
authentication is not a strong password-based authenticated key
exchange even when used with Diffie-Hellman key establishment."

If CMP or LAMPS generally needs a way to use passwords to authenticate
TLS it's worth reaching out to the TLS WG to ask them what you should
do here, or contrariwise if this profile for CMP is to use PSKs it
should likewise make explicit that you must not use passwords and
similar human memorable low-entropy secrets.

Nick.