Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd

["Dan Harkins" <[e-mail]>]

  Hi Ralf,

On Wed, December 11, 2013 8:03 am, Ralf Skyper Kaiser wrote:
> Hi,
>
> I'm concerned that it will happen in practice: Same password for all users
> to authenticate the server.
>
> I feel that the risk should be mentioned under 'Security Considerations'.
>
> "It should be noted that any user with the knowledge of the password can
> impersonate the server and perform
> a Man-in-the-middle attack against any other user who is using the same
> password".
>
> (Maybe some native english speaker can make this sound like Prince Charles
> would say it.)
>
> Comments welcome,

  I will add such a note to the Security Considerations, although I can't
guarantee it will sound like Prince Charles :-)

  thanks for your suggestion,

  Dan.

> regards,
>
> ralf
>
>
> On Tue, Dec 10, 2013 at 10:06 PM, Dan Harkins <[e-mail]> wrote:
>
>>
>>   Hi Ralf,
>>
>> On Tue, December 10, 2013 8:45 am, Ralf Skyper Kaiser wrote:
>> > Hi,
>> >
>> > I only joined the conversation recently. Had a quick read of
>> > http://tools.ietf.org/html/draft-ietf-tls-pwd-02 and have a question:
>> >
>> > In a scenario where multiple users use the same password (group
>> password):
>> >
>> > What prevents a user (who knows the password) to impersonating the
>> server
>> > and mount a MITM between another user and the real server?
>>
>>   Nothing prevents that. This protocol is not designed to support group
>> passwords. The password credential is assumed to be shared between
>> the client and the server only.
>>
>>   regards,
>>
>>   Dan.
>>
>>
>>
>