Re: [TLS] draft on new TLS key exchange

[Martin Rex <[e-mail]>]

Dan Harkins wrote:
> 
> The relation-- yours is "faster" than the unknown one-- means nothing.
> That knowledge doesn't help. Knowing how many iterations the hunting-
> and-pecking loop went through to find PE for an unknown password might
> but the relationship between two means nothing.  In fact, since both
> sides are contributing randomness into the hunting-and-pecking loop
> yours might be "faster" one time and considerably slower the next time.
> That knowledge doesn't really help.

The number of iterations for the hunting and pecking is visible in the
timing unless a reliable response time blending is employed (which would
have to account for an attacker running multiple requests in parallel to
slow down server-side processing).

Although both sides contribute randomness into the process, the only
unknown in the low-entropy password, everything else is revealed.
Since it is revealed, the attacker can use the timing "distance"
between processing his own password and processing guessed passwords
with the EXACT same parameters to sort out unlikely candidates.

-Martin