Re: [TLS] New cipher suites for SRP

[Hubert Kario <[e-mail]>]

On Monday 29 June 2015 09:20:23 Jeffrey Walton wrote:
> >> I've been thinking an improved SRP would be useful.  It should:
> >> 
> >> - Specify Modern cipher and hash algorithms as mentioned above
> >> 
> >> - Replace the existing SHA1+seed with a password whitening function
> >> 
> >>   like PBKDF2, so that in the event of a compromised server cracking
> >>   the password is harder, and also making online password guessing
> >>   attacks (sending lots of username+password pairs to the server) more
> >>   expensive*
> >> 
> >> - Deprecate the 1024-bit and the 1536-bit group, and the previous SRP
> >> 
> >>   ciphersuites; and say that these should only be chosen if the server
> >>   has a legacy verifier for a particular username which requires
> >>   them.
> > 
> > +1, provided we do two more things:
> >  - Change the negotiation so that user name is not exchanged in the clear
> >  - Change key exchange to do PFS
> 
> The clear text username/email will generate a security related
> finding. I suffered on a couple of years ago when using email
> addresses.
> 
> The wording should allow flexibility. Something like 'identity' or
> 'identity representation' so either the email or a hash of the email
> (or another way to identify the user) can be sent.
> 
> It seems like a chicken-and-the-egg problem. The client won't know
> what to send until the server responds with what it consumes based on
> the organization's security posture.

what I meant, is that we may need to wait for TLS1.3 standardisation before we 
can update the SRP ciphersuites to a standard at which browsers like Firefox 
will agree to ship it

-- 
Regards,
Hubert Kario
Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic