Re: [TLS] draft on new TLS key exchange

Philip Gladstone <pgladstone@cisco.com> Thu, 06 October 2011 23:18 UTC

Return-Path: <pgladstone@cisco.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6095A21F8BFE for <tls@ietfa.amsl.com>; Thu, 6 Oct 2011 16:18:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_12=0.6]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FJEKz5x-NQPQ for <tls@ietfa.amsl.com>; Thu, 6 Oct 2011 16:18:57 -0700 (PDT)
Received: from mtv-iport-1.cisco.com (mtv-iport-1.cisco.com [173.36.130.12]) by ietfa.amsl.com (Postfix) with ESMTP id D708221F8BEF for <tls@ietf.org>; Thu, 6 Oct 2011 16:18:56 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=pgladstone@cisco.com; l=8383; q=dns/txt; s=iport; t=1317943328; x=1319152928; h=message-id:date:from:mime-version:to:subject:references: in-reply-to; bh=BJAM9DSDR+9FOAALSuzypryb67G/gvMkfMTwNieI6XA=; b=jsSNWcgE/Tb2tprgjsiFa+3ytHKCng4k+RM6uLgWjn3SffGqihIeePX1 Gx0DfjVaYXIqTbx85U35XW5thZyGj46FRAWdP2wz2fo7L7kdzxPb/6jTz ra7drWUZyKt6nawv9+5WcKM29w/ZDpzHlXfYaGAqaGv1Ub60KN7vIsgjx s=;
X-Files: smime.p7s : 4899
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AngGAOw2jk6rRDoG/2dsb2JhbAA/A4R0lGuOWYEFgVMBAQEEEgEQVQ8CCxgJDwcLAgICBwMCAQIBCTwTCAEBHodjmgIBjEaRQgKEFwaBeYEUBI5QhR6FKIw6
X-IronPort-AV: E=Sophos; i="4.68,499,1312156800"; d="p7s'?scan'208"; a="6392511"
Received: from mtv-core-1.cisco.com ([171.68.58.6]) by mtv-iport-1.cisco.com with ESMTP; 06 Oct 2011 23:22:04 +0000
Received: from [171.69.143.168] (dhcp-171-69-143-168.cisco.com [171.69.143.168]) by mtv-core-1.cisco.com (8.14.3/8.14.3) with ESMTP id p96NM3jS009794 for <tls@ietf.org>; Thu, 6 Oct 2011 23:22:04 GMT
Message-ID: <4E8E3819.2000907@cisco.com>
Date: Thu, 06 Oct 2011 19:22:01 -0400
From: Philip Gladstone <pgladstone@cisco.com>
Organization: Cisco Systems, Inc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0) Gecko/20110922 Thunderbird/7.0
MIME-Version: 1.0
To: tls@ietf.org
References: <ce78cf414ed82d44135ebbb88e32959b.squirrel@www.trepanning.net>
In-Reply-To: <ce78cf414ed82d44135ebbb88e32959b.squirrel@www.trepanning.net>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha1"; boundary="------------ms000406000002060703060805"
Subject: Re: [TLS] draft on new TLS key exchange
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Oct 2011 23:18:57 -0000

On 10/5/2011 2:12 AM, Dan Harkins wrote:
>    Hi,
>
>    I just uploaded a -00 draft that defines a new key exchange
> for TLS that does not require certificates-- authentication using
> a simple password only. It can be found at:
>
>           http://tools.ietf.org/html/draft-harkins-tls-pwd-00
>
>    Please take a look. The authors solicit comments.
>
>
There is a note in Security Considerations section that indicates that 
an active attack that tried a hundred thousand passwords would be easily 
detected. The problem is that, in many cases, finding the password of a 
single user is sufficient (and you don't care which user it is). This 
means that you iterate over all users, only trying a single password for 
each user. This is *much* more difficult to detect and stop. [It does 
assume that usernames are drawn from a small pool. This may well be the 
case for electricity meters where the username might well be the device 
serial number -- and these are in a small, consecutive, range]

Philip

-- 
Philip Gladstone
Phone: +1 978-ZEN-TOAD (+1 978 936 8623)
Google: +1 978 800 1010
Ham radio: N1DQ