Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4D7612E874 for ; Mon, 16 Apr 2018 11:43:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.909 X-Spam-Level: X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fPLZ9Y158dLf for ; Mon, 16 Apr 2018 11:43:28 -0700 (PDT) Received: from mail-ot0-x234.google.com (mail-ot0-x234.google.com [IPv6:2607:f8b0:4003:c0f::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 68A4412E05D for ; Mon, 16 Apr 2018 11:43:28 -0700 (PDT) Received: by mail-ot0-x234.google.com with SMTP id w2-v6so7595023otj.12 for ; Mon, 16 Apr 2018 11:43:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=5JGM+yrVizEWhvPOiYk9BranYHfj7xycm9Zab5CtH5A=; b=s27oWKnGDKqTaAzlaLQD4SMj6rXNhZ8K1jgvTNLqkDZdJATOiE/Bufpp89IdzftmkM 4bIOT5D4aEU5RWe6Nmqqvd2qBVe0iIlttbuKODdZeWG4LkQnMrtMBh693hflkUmQRP0F hXyf5Lk3iHBWUw8fJWqXYabSArF4AuG/CjdF1iXl3/7qYC181gN1lO5c+C981gkrGoj1 TWMkiZQ5fTpi1d0CqJgyO/lQhRyYAZgwURYSdvqXKMyuw1oIlpk0ctMkq4IPRiKO77WS O5SULcXdKwktgT1pnX63qCO/P36xv82nRAVP61nTNagsTk8DhZ4Y9+0LZviJEPHHfDnD tg1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=5JGM+yrVizEWhvPOiYk9BranYHfj7xycm9Zab5CtH5A=; b=ZG2jr4DK8H9a9IS9yPvm3j8dLItcicSpid00JP0evQNfAUsAf8QL0yMy+aSqxKp2nr ZiJvYgIhYhtRwtOunJANuuUySTQtPA0XL+pji0kbYV8TFwBEpXtLcfZv/tNgVlWaZpYr KIQa/+5eglVOcgPAlcYPG6YvFsM2PnU4hxDuLTncep2htl7VI2kdh1C0MjxGAWfCAQyh ra2lAyPFGvLSqEzyDJpG9dAD0jFR4lyWu6a6b8R6aPIt0D/M9P93C9BekKpVJsWIVFeB Bt6kHQKB9t3IbA8qdGbVuX3u1KVyKwrYQMn5u/MEELIq0LGK5eey1bkD2f/0VLa0Ps4a Myzw== X-Gm-Message-State: ALQs6tD890U+Z61kRz39EXcUwKOrDYyK8B2g4srcqf2sd/CCPzFZLwJy v7+VDr8G2UWeNfGzdz/ixKCsT6m3tp+peYP6nb9nkg== X-Google-Smtp-Source: AIpwx48UV44xc13wmBRjMw0AOKDqWocJWBWaG2kyZ7LGiA6JWRj0EO1+T395fLcWSjvfy0h8dam+7RebNGESQQZGx24= X-Received: by 2002:a9d:738e:: with SMTP id j14-v6mr11502747otk.248.1523904207530; Mon, 16 Apr 2018 11:43:27 -0700 (PDT) MIME-Version: 1.0 Received: by 10.201.90.67 with HTTP; Mon, 16 Apr 2018 11:43:26 -0700 (PDT) In-Reply-To: References: <152345795593.1972.17855870949078823595.idtracker@ietfa.amsl.com> <140080C241BAA1419B58F093108F9EDC1DBF718C@UK-MAL-MBOX-01.dyson.global.corp> <140080C241BAA1419B58F093108F9EDC1DBFD7C7@UK-MAL-MBOX-02.dyson.global.corp> From: Richard Barnes Date: Mon, 16 Apr 2018 14:43:26 -0400 Message-ID: To: Jonathan Hoyland Cc: Tony Putman , "" , Benjamin Kaduk Content-Type: multipart/alternative; boundary="000000000000f640630569fb9841" Archived-At: Subject: Re: [TLS] Fwd: New Version Notification for draft-barnes-tls-pake-00.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Apr 2018 18:43:31 -0000 --000000000000f640630569fb9841 Content-Type: text/plain; charset="UTF-8" Hey Jonathan, Thanks for the comments. I've implemented them in my working copy of the draft, and in my implementation in mint. I have also changed it over to use SPAKE2+; I agree with Tony that this is necessary to guard against server compromise. https://github.com/bifurcation/tls-pake/commit/a9f097c3bfe43cf50001e1a340c7e2e693850d4b https://github.com/bifurcation/mint/pull/193 With regard to security properties: I don't think it's correct that an active attacker can do online password guessing. Everything that is revealed on the wire is blinded with fresh, per-connection entropy, and thus doesn't reveal anything about the password. --Richard On Mon, Apr 16, 2018 at 7:52 AM, Jonathan Hoyland < jonathan.hoyland@gmail.com> wrote: > Hi Richard, > > A few nits. > > * In the introduction you have the sentence > > DISCLAIMER: This is a work-in-progress draft of MLS and has not yet > > seen significant security analysis. > > Iiuc this draft has no connection to MLS, and this is a typo. > > * In the setup you define > > > o A DH group "G" of order "p*h", with "p" a large prime > > and > > > o A password "p" > > > The variable "p" has two different meanings, which is a bit confusing, > especially later on. > > * The document doesn't explicitly state that X and Y need to be non-zero. > > The requirement is in "I-D.irtf-cfrg-spake2", but it would be nice if the > warning was carried through. > > * In terms of security properties, iiuc an active adversary can do online > password guessing attacks, but a passive adversary cannot derive the > password from observing the messages. If that is the case perhaps a warning > about rate-limiting connection attempts is appropriate. > > Regards, > > Jonathan > > On Mon, 16 Apr 2018 at 10:50 Tony Putman wrote: > >> Hi Richard, >> >> I don't think that you can protect against server compromise with SPAKE2. >> The server can store w*N as you suggest, but it also has to store w*M >> because it must calculate y*(T-w*M). An attacker that learns w*M and w*N >> from a compromised server can then impersonate a client. >> >> The rest of your comments I agree with (though they are not all addressed >> in the updated draft). >> >> Tony >> >> > From: Richard Barnes [mailto:rlb@ipv.sx] >> > Sent: 13 April 2018 19:50 >> > >> > Hey Tony, >> > >> > Thanks for the comments. Hopefully we can adapt this document to tick >> more boxes for you :) >> > Since I had noticed some other errors in the document (e.g., figures >> not rendering properly), >> > I went ahead and submitted a new version that takes these comments into >> account. >> > >> > https://tools.ietf.org/html/draft-barnes-tls-pake-01 >> > >> > Some responses inline below. >> >> Dyson Technology Limited, company number 01959090, Tetbury Hill, >> Malmesbury, SN16 0RP, UK. >> This message is intended solely for the addressee and may contain >> confidential information. If you have received this message in error, >> please immediately and permanently delete it, and do not use, copy or >> disclose the information contained in this message or in any attachment. >> Dyson may monitor email traffic data and content for security & training. >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> > --000000000000f640630569fb9841 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hey Jonathan,

Thanks for the= comments.=C2=A0 I've implemented them in my working copy of the draft,= and in my implementation in mint.=C2=A0 I have also changed it over to use= SPAKE2+; I agree with Tony that this is necessary to guard against server = compromise.


With regard to security properties: I don't think it's correct t= hat an active attacker can do online password guessing.=C2=A0 Everything th= at is revealed on the wire is blinded with fresh, per-connection entropy, a= nd thus doesn't reveal anything about the password.=C2=A0

--Richard


On Mon, Apr 16, 2018 at 7:52 AM, Jo= nathan Hoyland <jonathan.hoyland@gmail.com> wrote:<= br>
Hi Richard,

A few nits.

=
* In the introduction you have the sen= tence
>=C2=A0DISCLAIMER: This is a work-in-progress draft o= f MLS and has not yet
   seen significant security analysis.Iiuc this draft has no connection to MLS,=
 and this is a typo.
 
* In the se=
tup you define=C2=A0
> o  A DH group =
"G" of order "p*h", with "p" a large prime
and 
> o  A password "p"

The variable &quo=
t;p" has two different meanings, which is a bit confusing, especially =
later on.
 
* The document doesn't explicitly state that X and Y=
 need to be non-zero.=C2=A0
The requirement is in "I-D.irtf-cfrg=
-spake2", but it would be nice if the warning was carried through.
=

* In terms of security properties,=
 iiuc an active adversary can do online password guessing attacks, but a pa=
ssive adversary cannot derive the password from observing the messages. If =
that is the case perhaps a warning about rate-limiting connection attempts =
is appropriate.=C2=A0

Regards,

Jonathan

On Mon, 16 Apr 2018 at 1=
0:50 Tony Putman <Tony.Putman@dyson.com> wrote:
Hi Richard,



I don't think that you can protect against server compromise with SPAKE=
2. The server can store w*N as you suggest, but it also has to store w*M be=
cause it must calculate y*(T-w*M). An attacker that learns w*M and w*N from=
 a compromised server can then impersonate a client. 



The rest of your comments I agree with (though they are not all addressed i=
n the updated draft). 



Tony



> From: Richard Barnes [mailto:rlb@ipv.sx] 

> Sent: 13 April 2018 19:50

>

> Hey Tony,

>

> Thanks for the comments.=C2=A0 Hopefully we can adapt this document to=
 tick more boxes for you :)=C2=A0 

> Since I had noticed some other errors in the document (e.g., figures n=
ot rendering properly), 

> I went ahead and submitted a new version that takes these comments int=
o account.

>

> https://tools.ietf.org/html/draft-ba=
rnes-tls-pake-01

>

> Some responses inline below.



Dyson Technology Limited, company number 01959090, Tetbury Hill, Malmesbury=
, SN16 0RP, UK.

This message is intended solely for the addressee and may contain confident=
ial information. If you have received this message in error, please immedia=
tely and permanently delete it, and do not use, copy or disclose the inform=
ation contained in this message or in any attachment.

Dyson may monitor email traffic data and content for security & trainin=
g.

_______________________________________________

TLS mailing list

TLS@ietf.org

https://www.ietf.org/mailman/listinfo/tls

--000000000000f640630569fb9841--