Re: [TLS] User Defined Key Pair

["OMAR HASSAN (RIT Student)" <[e-mail]>]

Hello Rich

When the user enrolls into one of those websites, and let's say he will go
with the second option of using a usb as a second factor authentication,
where the password is something he knows, and the usb is something he has.

when he plug the usb into the computer, the browser plugin will create a
random data stream and save it into a file in the usb, this file will be
passed to the genKeyPair function with the username and the password to
generate the key pair.

when the user tries to log in later into the website, he will plug the usb
into the computer and select that previously created file that will be
passed to the genKeyPair function with the username and the password to
generate the same key pair.

On the server the user public key will be used to encrypt the session key
pre-master that will be used by the browser and the server to generate the
session keys.

Self signed certificate is very dangerous because the user will not have a
way to verify the identity of the certificate owner and he could be a
victim to a man in the middle attack.


On Mon, Jun 24, 2013 at 9:34 PM, Salz, Rich <[e-mail]> wrote:

> **Ø  **and up to having a smart card, or hardware token that has large
> enough random seed that will work with the username and the password as
> a second factor authentication.****
>
> ** **
>
> That doesn’t seem to make sense – if you’re generating the keypair,
> predictably, from the inputs, how does a random seed enter into it?  And
> what is the second factor authentication in this situation?****
>
> ** **
>
> I’m starting to think you’re swimming out a little further into the deep
> end then you should.****
>
> ** **
>
> If you are trying to avoid CA’s, then why not just use self-signed
> certificates or similar like PGP?****
>
> ** **
>
>                 /r$****
>
> ** **
>
> --  ****
>
> Principal Security Engineer****
>
> Akamai Technology****
>
> Cambridge, MA****
>
> ** **
>