Re: [TLS] I-D ACTION:draft-ietf-tls-psk-null-00.txt

Bodo Moeller <bmoeller@acm.org> writes:
> On Fri, Jul 21, 2006 at 07:36:27AM -0700, Eric Rescorla wrote:
> With a low-entropy pre-shared key and without DH, there is plenty of
> randomness in the calculations, but most of this is openly
> transmitted.  Only the PSK is hidden, which is why plain PSK
> ciphersuites allow for offline dictionary attacks.
>
> Enter DH.  This allows us to have a lot more randomness in the
> protocol that is not openly transmitted, thus providing protection
> against passive dictionary attacks.
>
> However, if the server can arrange the DH result ZZ to be a specific
> value (such as 1 or p-1) by using small subgroups, that hidden
> randomness in the DH exchange no longer affects the final key exchange
> result.  Only the openly transmitted randomness and the PSK remain
> effective, so the server can try different guesses for the PSK in an
> offline dictionary attack after having received the client's
> "Finished" from this handshake.  So there's the dictionary attack
> again, almost as if DH wasn't even in the protocol.

But in order for the server to do this, it needs to be part
of the protocol, which means that it would have access
to the hidden randomness anyway. The attack you describe
is a single active attack + offline computation, just as
in the ordinary DH case.

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls