Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd

["Dan Harkins" <[e-mail]>]

On Tue, December 3, 2013 2:59 pm, Trevor Perrin wrote:
> On Tue, Dec 3, 2013 at 12:27 AM, Dan Harkins <[e-mail]> wrote:
>>
>>   Dear Rene,
>>
>> On Mon, December 2, 2013 6:28 am, Rene Struik wrote:
>>> Dear colleagues:
>>>
>>> I had a look at draft-ietf-tls-pwd-02. While I do appreciate the work
>>> that went into this draft, I have to concur with some other commenters
>>> (e.g., Doug Stebila, Bodo Moeller) that it is unclear what makes this
>>> protocol special compared to other contenders, both in terms of
>>> performance and detailed cryptanalysis. One glaring omission is
>>> detailed
>>> security evidence, which is currently lacking (cross-referencing some
>>> other standards that have specified the protocol does not by itself
>>> imply the protocol is therefore secure). I am kind of curious what
>>> technical advantages the "Dragonfly" protocol has over protocols that
>>> seem to have efficiency, detailed and crypto community reviewed
>>> evidence, such as, e.g., AugPAKE (which is another TLS-aimed draft) and
>>> others. So, if the TLS WG has considered a feature comparison, that
>>> would be good to share.
>>
>>   dragonfly is a balanced PAKE kind of exchange and it has certain
>> advantages over augmented PAKE schemes like TLS-SRP
>
> Wait, what?

  Yes, well good morning to you too!

> "Augmented PAKE" is of course better than "Balanced PAKE", as it
> allows the server to store non-usable credentials.

  This point was noted in the text you snipped in your response.

> TLS already has an "Augmented PAKE" - TLS/SRP (RFC 5054) which is
> implemented in OpenSSL and elsewhere.

  This was also mentioned in the text you snipped in your response.

> It's not used on the web, or widely, as the TLS layer is generally the
> wrong place for user authentication (e.g. leaks username, terminated
> at front-end machines without access to user credentials, etc).
>
> However, what little demand exists for a TLS PAKE seems like it's
> being adequately served by TLS-SRP.
>
> Why is the WG considering another PAKE with worse properties
> (non-augmented)?

  As has been discussed on the list, because it also has better
properties. And it has useful applications.

  A better question is, where have you been for the past 2 years?
You wait to question consideration of this draft not only after it's
been adopted as a working group item but also after WGLC has
closed on the draft!

  Dan.