Re: [TLS] Should TLS 1.3 use an augmented PAKE by default?

Andy Lutomirski <luto@amacapital.net> Wed, 19 March 2014 16:06 UTC

MIME-Version: 1.0
In-Reply-To: <6b79e0820d349720f12b14d4706a8a5d.squirrel@webmail.dreamhost.com>
References: <53288C43.9010205@mit.edu> <5328B6DF.8070703@fifthhorseman.net> <5328C0C8.9060403@mit.edu> <6b79e0820d349720f12b14d4706a8a5d.squirrel@webmail.dreamhost.com>
From: Andy Lutomirski <luto@amacapital.net>
Date: Wed, 19 Mar 2014 09:06:23 -0700
Message-ID: <CALCETrUz8zCBHiq42GTnkkSaBcpA5pjSvk6kwwPjzn+MtBKMgA@mail.gmail.com>
To: ryan-ietftls@sleevi.com
Content-Type: text/plain; charset="ISO-8859-1"
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/Dl96oGI9PLmDFkCXarTov-l2EKs
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Should TLS 1.3 use an augmented PAKE by default?
Precedence: list

On Tue, Mar 18, 2014 at 10:54 PM, Ryan Sleevi <ryan-ietftls@sleevi.com> wrote:
> I have yet to hear of a good mail client
> "phishing" attack (you *are* validating your IMAP certs, right?), so this
> seems almost predominantly an issue of attacker-controlled UI - that is,
> the web.

Even for IMAP, using PAKE, augmented or balanced, would give a
significant amount of protection against MITMs who have compromised a
CA.  Since compromising a CA seems to be a popular thing to do these
days, resisting these attacks at the protocol level would add
considerable value.

--Andy

[TLS] Should TLS 1.3 use an augmented PAKE by def… Andy Lutomirski
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Daniel Kahn Gillmor
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Andy Lutomirski
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Ryan Sleevi
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Andy Lutomirski
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Andy Lutomirski
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Ryan Sleevi
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Anders Rundgren
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Ryan Sleevi
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Peter Sylvester
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Andy Lutomirski
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Andy Lutomirski
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Yoav Nir
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Daniel Kahn Gillmor
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Paul Hoffman
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Yoav Nir
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Daniel Kahn Gillmor
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Robert Cragie
[TLS] bootstrapping of constrained devices (was: … Rene Struik
Re: [TLS] bootstrapping of constrained devices Anders Rundgren
Re: [TLS] bootstrapping of constrained devices (w… Michael Sweet
Re: [TLS] bootstrapping of constrained devices (w… t.petch
Re: [TLS] bootstrapping of constrained devices (w… Michael Sweet
Re: [TLS] bootstrapping of constrained devices Anders Rundgren
Re: [TLS] bootstrapping of constrained devices (w… Max Pritikin (pritikin)
Re: [TLS] bootstrapping of constrained devices (w… Don Sturek
Re: [TLS] bootstrapping of constrained devices Robert Cragie
Re: [TLS] bootstrapping of constrained devices Watson Ladd
Re: [TLS] bootstrapping of constrained devices Paterson, Kenny
Re: [TLS] bootstrapping of constrained devices Feng Hao
Re: [TLS] bootstrapping of constrained devices Paterson, Kenny
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Yaron Sheffer
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Yaron Sheffer
Re: [TLS] bootstrapping of constrained devices Feng Hao
Re: [TLS] bootstrapping of constrained devices Dan Harkins