Re: [TLS] PSK in 1.3?

[Ilari Liusvaara <[e-mail]>]

On Tue, Oct 21, 2014 at 11:45:48AM -0700, Dan Harkins wrote:
> 
> On Tue, October 21, 2014 9:02 am, Viktor Dukhovni wrote:
> > On Mon, Oct 20, 2014 at 01:34:38PM -0700, Dan Harkins wrote:
> >
> >> The ciphersuites are _completely oblivious_
> >> to the type and quality of the credential they use. You can't claim the
> >> _protocol_ is resistent to dictionary attack if the protocol can be used
> >> in a manner that makes it susceptible to dictionary attack.
> >
> > No protocol is resistant to dictionary attack under the above
> > definition.
> 
>   The point is that increasing the size of the PSK does not make the
> _protocol_ resistant to dictionary attack. It just makes the attack
> harder to successfully conclude.

>   And there are protocols that are resistant to dictionary attack under
> that definition. There's one in the paper. Or look at your favorite PAKE.

There is a difference between collecting enough information to break
the protocol (which is quite little with _any_ practical protocol) and
collecting enough information to "easily" break the protocol.


Whole practical cryptography is based on the assumption that it doesn't
matter if attacker has enough information to break it, if the
computation is just too titanic.


However, if you have things like long-term passwords involved, that
are easily breakable (due to insufficient entropy) given some
information, one wants to make collecting that information hard.
This is what PAKEs are about.


However, proper PSKs have high entropy, so even with enough
information, it is very difficult to break one.



-Ilari