Re: [TLS] is it good using password for authentication only?

Maybe I realize the problem. The PasswordVerify message is susceptible to
offline dictionary attacks.

Dose it become resistant to the attack if we add some secret generated from
master-secret into the HASH?

  PasswordVerify = HASH(username, passward, handshake_message_hash,
master-secret, label)

This becomes involved with key-exchange, but it is not involved with any
specific key-exchange method.
It just need the key-exchange result.

Bingzheng

> -----Original Message-----
> From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Bingzheng Wu
> Sent: Thursday, June 18, 2015 11:08 AM
> To: tls
> Subject: [TLS] is it good using password for authentication only?
> 
> Hi all,
> 
> I have a question about authentication and key-exchange.
> 
> TLS 1.3 removes RSA and DH static key-exchange, which mixs authentication
> and key-exchange together.
> However there are some PAKE models for TLS, e.g. RFC 5054 and 2 drafts.
> I think that PAKE mixs them together too.
> 
> Which is better, mixing them together, or keeping them independent to each
> other?
> Is it possible to use password for authentication only?
> 
> 
> Here is a example handshake flow for password-based authentication:
> 
>   ClientHello
>   ClientKeyshare  -->
>                           ServerHello
>                           ServerKeyshare
>                           PasswordVerify
>                      <--  Finished
>   PasswordVerify
>   Finished       -->
> 
> where:
> 
>   ClientHello takes an extension to carry username.
> 
>   PasswordVerify takes the verifier based on password, which could be:
>       HASH(username, passward, handshake_message_hash, label)
>       where handshake_message_hash is defined in TLS 1.3,
>       and label is "TLS 1.3, server PasswordVerify" or "TLS 1.3, client
>       PasswordVerify".
> 
>   and other messages keep the same with TLS 1.3.
> 
> 
> This could work with Certificate authentication together, by server adding
> Certificate and CertificateVerify messages following PasswordVerify, and
client
> verifying them both.
> 
> 
> Is this ok?
> 
> I think this makes it easier to merge passward-based authentication into
TLS
> 1.3.
> 
> 
> Thanks in advance,
> Bingzheng Wu
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls