Re: [TLS] New cipher suites for SRP

Geoff Keating <geoffk@geoffk.org> Fri, 17 July 2015 15:01 UTC

Return-Path: <geoffk@geoffk.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 344161A6FF2 for <tls@ietfa.amsl.com>; Fri, 17 Jul 2015 08:01:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.601
X-Spam-Level:
X-Spam-Status: No, score=-1.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h-zIgy3KABBh for <tls@ietfa.amsl.com>; Fri, 17 Jul 2015 08:01:24 -0700 (PDT)
Received: from dragaera.releasedominatrix.com (dragaera.releasedominatrix.com [198.0.208.83]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65A9E1A6FBB for <tls@ietf.org>; Fri, 17 Jul 2015 08:01:24 -0700 (PDT)
Received: from [10.0.69.133] (athyra.geoffk.org [198.0.208.82]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by dragaera.releasedominatrix.com (Postfix) with ESMTP id 92A9E33D02E; Fri, 17 Jul 2015 15:01:23 +0000 (UTC)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2102\))
From: Geoff Keating <geoffk@geoffk.org>
In-Reply-To: <38634A9C401D714A92BB13BBA9CCD34F1665ADA2@mail-essen-01.secunet.de>
Date: Fri, 17 Jul 2015 08:01:34 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <7532E1F9-23E6-4B7D-AC1A-ABBEE5BD5D7A@geoffk.org>
References: <20150626234801.ED7DDE04DA@smtp.hushmail.com> <201506262101.57121.davemgarrett@gmail.com> <m2d20hbz0z.fsf@localhost.localdomain> <36814552.ToKCXeCVxV@pintsize.usersys.redhat.com> <6ce70b2d45a6aa67aae04ef7e6940ca7.squirrel@www.trepanning.net> <38634A9C401D714A92BB13BBA9CCD34F1665ADA2@mail-essen-01.secunet.de>
To: =?windows-1252?Q?=22Schmidt=2C_J=F6rn-Marc=22?= <Joern-Marc.Schmidt@secunet.com>
X-Mailer: Apple Mail (2.2102)
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/Ilh_GY5NXEi214yvR_OKg9Au7LM>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] New cipher suites for SRP
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 17 Jul 2015 15:01:26 -0000

> On 17 Jul 2015, at 1:38 am, Schmidt, Jörn-Marc <Joern-Marc.Schmidt@secunet.com> wrote:
> 
>>> - Change the negotiation so that user name is not exchanged in the clear
>>> - Change key exchange to do PFS
> 
>> TLS-pwd already supports both of these. It also supports ECC too,
>> which is problematic with the current SRP protocol.

In the language of the CFRG draft, TLS-pwd is “balanced” where SRP is “augmented”,
so they’re not really equivalent, correct?

> I agree: Instead of modifying SRP I would prefer introducing a new PAKE
> scheme. 
> On CFRG I recently submitted a draft on requirements for such schemes
> (https://www.ietf.org/mail-archive/web/cfrg/current/msg07005.html).
> 
> Or to be even more flexible - how about defining a generic way to include
> PAKE in TLS to prevent a whole bunch of ExtensionTypes and CipherSuites by
> merging them into one "PAKE_Auth”?

This is possible, but you’d need to have the client and server negotiate based on
what they have.  For example, if the server has a SRP verifier from the current
protocol, but the client has a stored PBKDF2 hash of the password for that server,
they cannot communicate and would need to pick a different cipher suite.  I am not
sure how you can do this without revealing the existence of an account under some
circumstances.  So this might be a situation where fewer protocol options is better.