Re: [TLS] New cipher suites for SRP

[Jeffrey Walton <[e-mail]>]

>> I've been thinking an improved SRP would be useful.  It should:
>>
>> - Specify Modern cipher and hash algorithms as mentioned above
>>
>> - Replace the existing SHA1+seed with a password whitening function
>>   like PBKDF2, so that in the event of a compromised server cracking
>>   the password is harder, and also making online password guessing
>>   attacks (sending lots of username+password pairs to the server) more
>>   expensive*
>>
>> - Deprecate the 1024-bit and the 1536-bit group, and the previous SRP
>>   ciphersuites; and say that these should only be chosen if the server
>>   has a legacy verifier for a particular username which requires
>>   them.
>
> +1, provided we do two more things:
>
>  - Change the negotiation so that user name is not exchanged in the clear
>  - Change key exchange to do PFS
>
The clear text username/email will generate a security related
finding. I suffered on a couple of years ago when using email
addresses.

The wording should allow flexibility. Something like 'identity' or
'identity representation' so either the email or a hash of the email
(or another way to identify the user) can be sent.

It seems like a chicken-and-the-egg problem. The client won't know
what to send until the server responds with what it consumes based on
the organization's security posture.

Jeff