Re: [TLS] New cipher suites for SRP

[Jeffrey Walton <[e-mail]>]

On Mon, Jun 29, 2015 at 9:57 AM, Hubert Kario <[e-mail]> wrote:
> On Monday 29 June 2015 06:55:59 Tom Wu wrote:
>> > +1, provided we do two more things:
>> >
>> >
>> >  - Change the negotiation so that user name is not exchanged in the clear
>> >  - Change key exchange to do PFS
>>
>>
>> SRP already provides PFS automatically.
>
> I'm rather fuzzy about the details (I've read the RFC quite a bit ago), but
> isn't the server key share static in SRP?
>
No.

Here's the step that calls out its a random key (from RFC 5054):

    2.5.3.  Server Key Exchange

   The server key exchange message contains the prime (N), the generator
   (g), and the salt value (s) read from the SRP password file based on
   the user name (I) received in the client hello extension.

   The server key exchange message also contains the server's public
   value (B).  The server calculates this value as B = k*v + g^b % N,
   where b is a random number that SHOULD be at least 256 bits in length
   and k = SHA1(N | PAD(g)).

Things like resumption can affect the forward secrecy, though. But all
cipher suites suffer it equally.

Jeff