IETF Logo Mail Archive

Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd

"Dan Harkins" <dharkins@lounge.org> Tue, 10 December 2013 22:07 UTC

Return-Path: <dharkins@lounge.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE7071AE08B for <tls@ietfa.amsl.com>; Tue, 10 Dec 2013 14:07:00 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.867
X-Spam-Level:
X-Spam-Status: No, score=-3.867 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h52TWCQVzhE3 for <tls@ietfa.amsl.com>; Tue, 10 Dec 2013 14:06:58 -0800 (PST)
Received: from colo.trepanning.net (colo.trepanning.net [69.55.226.174]) by ietfa.amsl.com (Postfix) with ESMTP id DF3A41AE06D for <tls@ietf.org>; Tue, 10 Dec 2013 14:06:58 -0800 (PST)
Received: from www.trepanning.net (localhost [127.0.0.1]) by colo.trepanning.net (Postfix) with ESMTP id 6DA0E10224008; Tue, 10 Dec 2013 14:06:53 -0800 (PST)
Received: from 199.127.104.10 (SquirrelMail authenticated user dharkins@lounge.org) by www.trepanning.net with HTTP; Tue, 10 Dec 2013 14:06:53 -0800 (PST)
Message-ID: <7a5a264b029777f3c0b2d2f97a362463.squirrel@www.trepanning.net>
In-Reply-To: <CA+BZK2p70bYGGMjJC-Dm2r4bzP_YzKh0ZODiNvnwVcSDJSLZAw@mail.gmail.com>
References: <3065D910-832C-47B6-9E0B-2F8DCD2657D2@cisco.com> <CA+BZK2p70bYGGMjJC-Dm2r4bzP_YzKh0ZODiNvnwVcSDJSLZAw@mail.gmail.com>
Date: Tue, 10 Dec 2013 14:06:53 -0800
From: Dan Harkins <dharkins@lounge.org>
To: Ralf Skyper Kaiser <skyper@thc.org>
User-Agent: SquirrelMail/1.4.14 [SVN]
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
Cc: tls@ietf.org
Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 10 Dec 2013 22:07:00 -0000

  Hi Ralf,

On Tue, December 10, 2013 8:45 am, Ralf Skyper Kaiser wrote:
> Hi,
>
> I only joined the conversation recently. Had a quick read of
> http://tools.ietf.org/html/draft-ietf-tls-pwd-02 and have a question:
>
> In a scenario where multiple users use the same password (group password):
>
> What prevents a user (who knows the password) to impersonating the server
> and mount a MITM between another user and the real server?

  Nothing prevents that. This protocol is not designed to support group
passwords. The password credential is assumed to be shared between
the client and the server only.

  regards,

  Dan.

v2.23.0 | Report a Bug | By Email