Re: [lamps] draft-ietf-lamps-lightweight-cmp-profile-05 concern

[Nick Lamb <[e-mail]>]

On Tue, 16 Mar 2021 17:43:03 +0000
"Brockhaus, Hendrik" <[e-mail]> wrote:

> I struggled to provide some guidance on which cypher suites to use
> with shared secret information together with TLS in the Lightweight
> CMP Profile as presented during IETF 110. One option is also to drop
> these recommendation, if there is no adequate cypher suite to be used
> with shared secret information and TLS 1.3, as TLS is not required
> for protecting CMP messages.

I can see several ways forward. One option would be as you say not to
suggest TLS for this purpose at all. One benefit here is that it
doesn't over-promise. TLS gives you confidentiality, but simple
password-based schemes aren't going to achieve that and so probably
shouldn't promise it.

It should I think be obvious that PBMAC1 does not protect against an
offline attack by an adversary guessing your password, but without
strong guidance it's unlikely to be obvious that using the password for
TLS PSK (which is an online protocol) also does not protect against such
offline attacks.

Another option would be to make clear that shared secrets for this
purpose MUST NOT be human memorable passwords.  Someone more familiar
with the deployed applications might have an insight into whether such
applications might actually use say 128-bit random secrets rather than
a short human memorable password or if this is never likely to be used
in the real world.

Another option would be something like draft-sullivan-tls-opaque which
provides an actual password based AKE for TLS 1.3 but this is quite
complicated and may not meet your needs for a "Lightweight" profile, it
is also of course a draft, and so depending on it would delay
completion of the profile.

Nick.