Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd

[Bodo Moeller <[e-mail]>]

Mohamad Badra <[e-mail]>:

For info, I submitted during 2007 and 2008 two documents to enable
> authentication using passwords.
>
> http://tools.ietf.org/id/draft-badra-tls-password-ext-01.txt
> ftp://ftp.kfki.hu/pub/documents/iana/drafts/draft-badra-tls-password-00.txt
>
> Both of them are simple, and secure enough to enable password-based
> authentication
>

That's something different from a password-authenticated key exchange,
though.  In your specs, the client sends the password to the server (in
encrypted form).  If the server isn't actually the legitimate party
expected by the client, this compromises the password.  So the client still
depends heavily on authenticating the server first.

In a *password-authenticated* key exchange, the client doesn't readily
compromise the password if an attacker poses as the server.  So the client
doesn't have to do the usual certificate-based check to authenticate the
server (although, depending on the specific scheme, you could optionally
still do that, to mitigate certain kinds of attacks) -- that's why it's
called "password-authenticated": authentication is inherently based on that
password.  All an attacker posing as the server should get is *one* single
attempt (per client-initiated connection) to guess the password; all the
server will learn, unless that guess happens to be correct, is that that
wasn't the right password.

Bodo