Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd

[Bodo Moeller <[e-mail]>]

Peter Sylvester <[e-mail]>:

The server's ability to send arbitrary values for negotiation does not mean
> that the client blindly accepts them.


> In the SRP code of OpenSSL for example, by default, the client accepts
> only a few groups, the one's from the RFC
>

That works, of course.  The TLS-SRP RFC says that "Because of the
difficulty of checking for [trapdoor] primes in real time, clients SHOULD
only accept group parameters that come from a trusted source, such as those
listed in Appendix A, or parameters configured locally by a trusted
administrator."  (Language added as of draft-ietf-tls-srp-09, after I'd
presented the attack idea.)

draft-ietf-tls-pwd-02 does not appear to have a similar provision.  If
there are no standardized primes that you can rely on for interoperability,
there's the danger that implementations might do what the specification
appears to suggest, which is to do the same checks they'd be doing to
validate parameters for a DH key exchange.  (This is useful as a sanity
check to prevent certain types of severely broken implementations from
getting deployed, but it is not sufficient to protect against malicious
parties.)

Bodo