Re: [TLS] PSK in 1.3?

[Viktor Dukhovni <[e-mail]>]

On Mon, Feb 23, 2015 at 10:08:16PM -0500, Stephen Checkoway wrote:

> > It is obvious that a making n large enough can make a dictionary attack
> > moot. I have not said otherwise. It just doesn't make _the protocol_
> > resistant to dictionary attack.
> 
> This isn't a useful distinction then since no mode of TLS is resistant to dictionary attacks by what I take to be your definition.

I'd like to suggest that this thread is going nowhere at present.

I don't think any of the below are controversial.

    * PSK is vulnerable to dictionary attacks when poor key management
      leads to a reduced key space.

    * PAKE protocols offer greater resistance to off-line dictionary
      attacks.

    * PSK *with properly selected keys* is secure in practice, once
      the brute force search is at least as expensive as brute-forcing
      the symmetric-algorithm keyspace.

    * No key management approach is perfect.

At which point it makes sense to step back and decide whether the
risk of reduced key-space with PSK warrants dropping support, even
though other approaches that are staying also have potential flaws.

Is there a suitable PAKE that is ready to replace all applications
of PSK?  Is it practical in all the environments that would otherwise
opt to use PSK?  If PSK is simply an obsolete needlessly weaker
shared secret system, then good riddance.  If not, then the discussion
should be about why PSK is more practical despite its limitations.

-- 
	Viktor.