Re: [TLS] I-D Action: draft-ietf-tls-pwd-04.txt

["Dan Harkins" <[e-mail]>]

On Fri, March 28, 2014 2:49 pm, Watson Ladd wrote:
> On Fri, Mar 28, 2014 at 3:53 PM,  <[e-mail]> wrote:
>>
>> A New Internet-Draft is available from the on-line Internet-Drafts
>> directories.
>>  This draft is a work item of the Transport Layer Security Working Group
>> of the IETF.
>>
>>         Title           : Secure Password Ciphersuites for Transport
>> Layer Security (TLS)
>>         Authors         : Dan Harkins
>>                           Dave Halasz
>>         Filename        : draft-ietf-tls-pwd-04.txt
>>         Pages           : 35
>>         Date            : 2014-03-28
>
> Why should we trust this PAKE? I've got only partial results in this
> direction, but they are not sufficient for me to adopt it when better
> validated alternatives exist like those based on distrustful MPC.

  I'm not sure what you mean by "we" but it got quite a bit of review
in CFRG and that resulted in fixing the only real technical issue brought
up: potential for a side-channel attack. Scott Fluhrer came up with a
way to do a random blinding of a value when checking whether its a
quadratic residue that effectively addresses that concern.

  These ciphersuites are drop-in replacements for things like PSK
ciphersuites, not for popular ones used in browsers. In fact, I agree
with several on this list who are pointing out that using a PAKE in a
browser is not a good idea.

  If you're happy doing cert-based TLS, or happy with HTTP Digest
authentication (or whatever) then these are not for you. But the entirety
of networking  is not "the web" and these ciphersuites work well with
some specific use cases (see the draft).

  regards,

  Dan.