Re: [TLS] PSK in 1.3?

["Dan Harkins" <[e-mail]>]

On Tue, October 21, 2014 9:02 am, Viktor Dukhovni wrote:
> On Mon, Oct 20, 2014 at 01:34:38PM -0700, Dan Harkins wrote:
>
>> The ciphersuites are _completely oblivious_
>> to the type and quality of the credential they use. You can't claim the
>> _protocol_ is resistent to dictionary attack if the protocol can be used
>> in a manner that makes it susceptible to dictionary attack.
>
> No protocol is resistant to dictionary attack under the above
> definition.

  The point is that increasing the size of the PSK does not make the
_protocol_ resistant to dictionary attack. It just makes the attack
harder to successfully conclude.

  This is not my definition by the way. But instead of paraphrasing, let
me quote from "Authenticated Key Exchange Secure Against Dictionary
Attacks" by Bellare, Pointcheval, and Rogaway:

        "A theorem asserting security of some protocol make qualitative
         how much _computation_ helps and just how much _interaction_
         does. One sees whether or not one has security against dictionary
         attacks by looking to see if maximal adversarial advantage grows
         primarily with the ratio of interaction to the size of the password
         space."

Increasing the size of the PSK just makes the "password space" larger
but that has no effect on interaction. With the TLS PSK ciphersuites,
there's one interaction and then there's a whole bunch of computation.
Increasing the amount of computation necessary doesn't make the
protocol resistant to dictionary attack because there's still just one
interaction-- the adversarial advantage does not grow primarily with
the ratio of interaction to the size of the search space.

  And there are protocols that are resistant to dictionary attack under
that definition. There's one in the paper. Or look at your favorite PAKE.

  Dan.