Re: [TLS] TLS-PWD vs. TLS-SRP

[SeongHan Shin <[e-mail]>]

FYI
AugPAKE can be implemented over any dl/ec groups and it provides resistance
to server compromise (like SRP).

Regards,
Shin


On Thu, Nov 7, 2013 at 7:29 AM, Dan Harkins <[e-mail]> wrote:

>
> On Wed, November 6, 2013 1:43 pm, Fabrice wrote:
> >> On Nov 6, 2013, at 13:02, "Dan Harkins" <[e-mail]> wrote:
> >>
> >>
> >>  Hi Shin,
> >>
> >>> On Wed, November 6, 2013 12:15 pm, SeongHan Shin wrote:
> >>> Hi all,
> >>>
> >>> The TLS WG is about to issue a LC for tls-pwd.
> >>> http://tools.ietf.org/html/draft-ietf-tls-pwd-01
> >>>
> >>> Is there any advantages of tls-pwd over tls-srp?
> >>
> >>  TLS-srp binds the password to a particular finite cyclic group
> >> and the user must use that group for the life of the password.
> >
> > Isn't that required for every protocol that only stores a verifier on the
> > server, rather than a password equivalent?
> >
> > My understanding of TLS-PWD is that the server need to store a password
> > equivalent (called the "base" in the TLS-PWD drafts), and as such does
> not
> > have some of the desirable properties of SRP (or AugPAKE) related to
> > server compromises.
>
>   Your understanding is correct. There are drawbacks with the "desirable
> properties" of both TLS-srp and TLS-pwd. Now you have a choice based on
> what you value more.
>
>   Dan.
>
>
>
>


-- 
------------------------------------------------------------------
SeongHan Shin
Research Institute for Secure Systems (RISEC),
National Institute of Advanced Industrial Science and Technology (AIST),
Central 2, 1-1-1, Umezono, Tsukuba City, Ibaraki 305-8568 Japan
Tel : [phone]
Fax : [phone]
E-mail : [e-mail]
------------------------------------------------------------------