Re: [TLS] PSK in 1.3?

["Dan Harkins" <[e-mail]>]

On Mon, October 20, 2014 1:00 pm, Peter Gutmann wrote:
> Dan Harkins <[e-mail]> writes:
>
>>There is nothing to flesh out because you seem to not understand what a
>>dictionary attack is-- but you're in company because neither did the
>> editors
>>of that RFC.
>>
>>Protocols that use a static, symmetric credential like a PSK (or a
>> password,
>>the difference is semantic) are all flawed because the adversary is
>> always
>>assumed to have access to a pool from which the PSK (or password is
>> drawn.
>
> As Watson has already pointed out, the protocol name is "preshared key",
> not
> "preshared password" as you seem to think.  I've been party to the
> deployment
> of several PSK-based devices/systems, for which the pool from which the
> PSK is
> drawn is well-known to an attacker, it ranges from 00 00 00 00 00 00 00 00
> 00
> 00 00 00 00 00 00 to FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF.
> Since
> I've now given you what you need to know, I'll let you go away and
> brute-force
> the system.  Let us know when you're done.

  Is that the "royal we"?

  And, you need to supply a bit more than that information to enable
a dictionary attack (such as the data that contains a hash of the PSK plus
other information known to the attacker). But you were making a sarcastic
point, not a technical point weren't you?

  The issue is not so much the range, it's which values in that range are
going to be valid PSKs and which are not. But, again, you were being
sarcastic so a technical response is somewhat unnecessary.

  And, yes, I did notice that Watson said that the RFC is "pre-shared key"
and not "pre-shared password" but, as I said (did you notice?), that is
merely a semantic difference. The ciphersuites are _completely oblivious_
to the type and quality of the credential they use. You can't claim the
_protocol_ is resistent to dictionary attack if the protocol can be used
in a manner that makes it susceptible to dictionary attack.

  I have witnessed, and sadly been party to, many deployments of PSK-based
devices/systems for which the pool that the PSK is drawn from is the same
pool as you describe above. Unfortunately, they did something like
PBKDF2(easy-to-enter-keystream) to generate this PSK, which is not a
"password", in this huge range. And I encourage you to search the
Internet for "coWPAtty" to get a nice tool to attack them. Of course, you
will need to also supply a tcpdump of the exchange but that's easy to
capture.

  regards,

  Dan.