Re: [TLS] PSK in 1.3?

[Manuel Pégourié-Gonnard <[e-mail]>]

On 20/10/2014 19:06, Dan Harkins wrote:
>   There is nothing to flesh out because you seem to not understand
> what a dictionary attack is-- but you're in company because neither
> did the editors of that RFC.
> 
>   Protocols that use a static, symmetric credential like a PSK (or a
> password, the difference is semantic) are all flawed because the
> adversary is always assumed to have access to a pool from which
> the PSK (or password is drawn. Resistance against dictionary attack
> is then a demonstration that the advantage gained by the adversary
> is due to _interaction_ and not _computation_.
> 
>   Merely making the pool from which the PSK is drawn, for instance
> by making it a bigger or including mixed case, etc, does not make
> the protocol resistant to dictionary attack.

>From a theoretical standpoint, the PSK key exchange is indeed vulnerable to a
dictionary attack with this definition. In practice, if your keys are 128-bit
long and chosen uniformly at random using a good source of entropy, I doubt any
real-world adversary is able to gain a non-negligible advantage in the
foreseeable future.

Also, it should be noted that with this definition, the TLS session keys are
vulnerable to a dictionary attack too. In practice, it's not a problem either
for the same reason. Obviously the difference between the pre-shared key and the
TLS session keys is that the later is short-term while the former is long-term.
Which basically boils down to the point that PSK lacks FS.

Are you sure you have point besides:
- pre-shared key must be chosen with sufficient entropy and
- PSK does not offer FS?

Manuel.

PS: by the way, it seems to me RSA key exchange as it exists in TLS 1.2 is also
vulnerable to dictionary attack with the above definition. (Obviously there are
more efficient attacks here.)