Re: [TLS] I-D Action: draft-ietf-tls-pwd-04.txt

["Dan Harkins" <[e-mail]>]

On Tue, April 1, 2014 12:30 pm, Nico Williams wrote:
> On Fri, Mar 28, 2014 at 8:40 PM, Watson Ladd <[e-mail]>
> wrote:
>> PSK has no security? That's ridiculous: if high-entropy keys are used
>> it is fairly easy to see it is secure.
>
> TLS-PSK did not specify a PBKDF either, so it can't be used with
> passwords, therefore we might as well assume high-quality keys for
> TLS-PSK.  Therefore you're quite right.

  There is nothing in the protocol that prevents it from being used with
passwords. You're not only assuming something about the nature of the
PSK, you're assuming something about the people that use the protocol
and that is quite naive.

  Furthermore making assumptions about the nature of the PSK does not
change the fact that TLS-PSK has a defect: the advantage an attacker
gains is through computation and not interaction. And for the non-DHE
ciphersuites, that defect can be exploited through passive attack!

> Even if the server must store a password-equivalent I'd still want a
> decent PBKDF to be used for any protocol that derives keying material
> from passwords!

  Why? Deterministically hashing a secret 1000 times or 4000 times
does not increase the entropy in the secret. A PBKDF is just supposed
to increase the work factor of the attacker, it does nothing to the
resulting keying material.

  Wi-Fi specifies a PBKDF when using a PSK and the exchange is
essentially the same as the non-DHE TLS-PSK ciphersuites. That
protocol is horribly broken and tools exist on the Internet to attack
it. And guess what? People still use it with weak, low-entropy PSKs
in spite of assumptions to the contrary.

  Dan.