[TLS] 转发: Re: ´ð¸´: Re: OT: WPA2-PSK vs. TLS-PSK (was about the PWD Proposal)

[[e-mail]]

Regards~~~

-Sujing Zhou
----- 转发人 周苏静00132831/user/zte_ltd 时间 2011-12-14 13:55 -----

周苏静00132831/user/zte_ltd
2011-12-14 13:53

收件人
"Dan Harkins" <[e-mail]>
抄送

主题
答复: Re:      ´ð¸´: Re: [TLS] OT: WPA2-PSK vs. TLS-PSK      (was  about 
the PWD Proposal)





Regards~~~

-Sujing Zhou

"Dan Harkins" <[e-mail]> 写于 2011-12-14 13:42:19:

> 
>   Hello,
> 
> On Tue, December 13, 2011 5:28 pm, [e-mail] wrote:
> > Regards~~~
> >
> > -Sujing Zhou
> >
> > [e-mail] дÓÚ 2011-12-13 10:46:15:
> >
> >>
> >> On Mon, December 12, 2011 6:01 pm, Martin Rex wrote:
> >> > Off-topic:
> >>
> >>   Indeed! :-)
> >>
> >> > Dan Harkins wrote:
> >> >>
> >> >>
> >>   Protocols that lose security when deployed in the easiest and most
> >> straightforward manner (i.e. the way everyone's gonna deploy it!) are
> >> extremely fragile. To tie it all back to what this thread used to be,
> >> when one uses a password with a protocol based on a zero knowledge
> >> proof
> >> there's a certain amount of robustness and misuse resistance. You
> >> should
> >> not share a password but if you do it will not give an adversary an
> >> advantage in determining the password because it still takes 1 active
> >> attack to some other protocol participant to check each candidate
> >> password in the dictionary-- do 50 attacks against a single device or
> >> 1 attack against 50 devices, it's no different.
> >
> > Is the PWD protocol in discussion a one based on zero knowledge proof?
> > I doubt it. Server knows the salted pwd at least, absolutly not zero
> > knowledge.
> 
>   A zero knowledge proof does not mean that both sides know nothing,
> it means that a proof of knowledge of a secret is provided without
> exposing anything about the secret (or some derivative of the secret).
> The only thing an adversary can learn is whether a single guess of the
> password is correct and it takes an active attack to learn that.

proof of knowledge should be diff with zero-knowledge, if the protocol 
under discussion 
is a real zero-knowledge or a proof of knowledge, a proof should be given 
showing that
attacker's view cannot be unnegligible distinguishable from random context 
in the case of zero knowledge
, or the knowledge can be extracted in the case of proof of knowledge.

As far as I know the most effient PoK is based on Schnorr's scheme, while 
no Pwd based authentication schemes
can be called a ZK protocol or a PoK。


> 
> > and dictionary attack is not needed, since what is realy needed to
> > authenticate the client
> > is the calculated PE (salted pwd).
> >
> >  Maybe I missed something, If I am wrong please point out.  Thanks!
> 
>   Well of course if an adversary knows the calculated PE it can
> do all sorts of things. How does the adversary learn the calculated
> PE though? The protocol is resistant to any attack the adversary can
> launch against it. If the server's database of passwords (salted or not)
> is compromised then all bets are off but that's not an attack against
> the protocol.

So , it is no point considering of salt should be taken here.

> 
>   regards,
> 
>   Dan.
> 
> 
> 



--------------------------------------------------------
ZTE Information Security Notice: The information contained in this mail is solely property of the sender's organization. This mail communication is confidential. Recipients named above are obligated to maintain secrecy and are not permitted to disclose the contents of this communication to others.
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the originator of the message. Any views expressed in this message are those of the individual sender.
This message has been scanned for viruses and Spam by ZTE Anti-Spam system.