Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd

Rene Struik <> Tue, 03 December 2013 14:16 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 5CF221AD694 for <>; Tue, 3 Dec 2013 06:16:00 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id IVuss9iujrUF for <>; Tue, 3 Dec 2013 06:15:56 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:4001:c03::231]) by (Postfix) with ESMTP id BB1911AD7C0 for <>; Tue, 3 Dec 2013 06:15:56 -0800 (PST)
Received: by with SMTP id tp5so22908627ieb.8 for <>; Tue, 03 Dec 2013 06:15:54 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type; bh=9TtMsowcxJqM0wDLbPzIOAPiTU5PMMe/c93OOpw5XDw=; b=I+eGqaK2kWytJ5mBOeR+OnoyEX5QMFw0kjQmG/dubTKbgN/Mlfi5tyEsVUwrgRJZgC lzvYqglTOesCOfoMzMyUmKbGP6arrP9zPF80vq4rv51TnIIlQZtx88ax26QZT+pbcdR+ QebQzEGJnKtFmYXgqLZZ9aWI3Yju6qsdWfiIsylaE+E2H/VzduCaSCz+DEbJqsLOeHQW 6JO4MpqtgnhBX64BSQRpBRxP3Ddog7LroY86Z3KCWzsFp10piyN68fg4Bx7moWXl++hR 4oOlGBadN6aNprivXShwMSQlCKrO7T40zS7Oq7rQc/RVNq3HN9rzInGiqmufMFpTD8Rs 0pPQ==
X-Received: by with SMTP id hs4mr2827126igb.34.1386080154150; Tue, 03 Dec 2013 06:15:54 -0800 (PST)
Received: from [] ( []) by with ESMTPSA id v9sm3247089igh.7.2013. for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 03 Dec 2013 06:15:53 -0800 (PST)
Message-ID: <>
Date: Tue, 03 Dec 2013 09:15:49 -0500
From: Rene Struik <>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.1.1
MIME-Version: 1.0
To: Dan Harkins <>
References: <> <> <>
In-Reply-To: <>
Content-Type: multipart/alternative; boundary="------------010906090002050602030700"
Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 03 Dec 2013 14:16:00 -0000

Hi Dan:

I could not find that CFRG had a LC on this. In case I missed this, 
please kindly provide a pointer.

Triggered by the TLS WG LC, I decided the review the Dragonfly protocol 
document last Friday (since TLS WG LC suggested CFRG had "blessed" this) 
and sent my review to the CFRG email reflector. One can find this review 

I suggest you have a discussion on how to fix security comments raised 
on the CFRG dragonfly protocol on that list.

As far as I am concerned, my TLS WGLC comments still stand.

Best regards, Rene

On 12/3/2013 3:27 AM, Dan Harkins wrote:
>    Dear Rene,
> On Mon, December 2, 2013 6:28 am, Rene Struik wrote:
>> Dear colleagues:
>> I had a look at draft-ietf-tls-pwd-02. While I do appreciate the work
>> that went into this draft, I have to concur with some other commenters
>> (e.g., Doug Stebila, Bodo Moeller) that it is unclear what makes this
>> protocol special compared to other contenders, both in terms of
>> performance and detailed cryptanalysis. One glaring omission is detailed
>> security evidence, which is currently lacking (cross-referencing some
>> other standards that have specified the protocol does not by itself
>> imply the protocol is therefore secure). I am kind of curious what
>> technical advantages the "Dragonfly" protocol has over protocols that
>> seem to have efficiency, detailed and crypto community reviewed
>> evidence, such as, e.g., AugPAKE (which is another TLS-aimed draft) and
>> others. So, if the TLS WG has considered a feature comparison, that
>> would be good to share.
>    dragonfly is a balanced PAKE kind of exchange and it has certain
> advantages over augmented PAKE schemes like TLS-SRP (which, unlike
> the augPAKE draft, is a published RFC that has been implemented).
> Namely, the domain parameter set is not fixed with the password and
> can be negotiated to provide security commensurate with that offered
> by the rest of the cipher suite. And yes, the drawback of a balanced
> PAKE scheme is that if the server is compromised and the password
> file exposed then an attacker can impersonate users (although, in my
> opinion, that is something of a dubious benefit since the server is
> already compromised and this will be the least of your problems).
>    This has already been discussed in this thread by the way.
>> I would recommend to ask CFRG to carefully review the corresponding
>> irtf-dragonfly-02 document (to my knowledge, there has been no LC and it
>> is still a draft document there) and align the TLS document
>> draft-ietf-tls-pwd-02 document with whatever comes out of that effort
>> (currently, there are some security-relevant differences). This time
>> window could also be used for firming up security rationale, thus
>> aleviating concerns on that front.
>    This suggestion has already been done.
>> Two final comments:
>> a) It is unclear why one should hard code in the draft that elliptic
>> curves with co-factor h>1 would be ruled out. After all, this would make
>> it much harder to extend the reach of the draft to prime curves with
>> co-factor larger than one and to binary curves.
>    You're right, it does prevent the use of binary curves and prime curves
> with a co-factor greater than one. That's the whole point. The motivation
> is to avoid walking through a patent mine field.
>> b) The probabilistic nature of the "hunting and pecking" procedure may
>> be a recipe for triggering implementation attacks. Wouldn't one be much
>> better off removing dependency on non-deterministic password-to-point
>> mappings (e.g., AugPAKE, Icart map, German BSI-password protocol)?
>    The "hunting and pecking" procedure is deterministic otherwise there
> would be no guarantee that each side arrived at the same element
> given the same input.
>    regards,
>    Dan.
>> Best regards, Rene
>> On 11/7/2013 8:11 PM, Joseph Salowey (jsalowey) wrote:
>>> This is the beginning of the working group last call for
>>> draft-ietf-tls-pwd-01.   The underlying cryptographic protocol for
>>> TLS-PWD has been reviewed by the IRTF CFRG group with satisfactory
>>> results.  The document needs particular attention paid to the
>>> integration of this mechanism into the TLS protocol.   Please send
>>> comments to the TLS list by December 2, 2013.
>>> - Joe
>>> (For the TLS chairs)
>>> _______________________________________________
>>> TLS mailing list
>> --
>> email: | Skype: rstruik
>> cell: +1 (647) 867-5658 | US: +1 (415) 690-7363
>> _______________________________________________
>> TLS mailing list

email: | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363