Re: [TLS] I-D ACTION:draft-ietf-tls-psk-null-00.txt

On Fri, Jul 21, 2006 at 02:49:06PM +0300, Pasi Eronen wrote:
> Bodo Moeller wrote:

>> Is there a good case for definining a DHE_PSK ciphersuite with NULL
>> encryption?  RSA_PSK involves server certificates, so it does not
>> solely rely on pre-shared keys for authentication.  DHE_PSK, however,
>> uses ephemeral Diffie-Hellman without certificate-based
>> authentication.  This is very useful when the key exchange is used to
>> obtain keys for symmetric encryption.  However, in these NULL
>> encryption ciphersuites, the key exchange is only used to derive
>> authentication keys, so there is only a very limited need for forward
>> security.  (DHE_DSK, when using NULL encryption, provides protection
>> against exposure of a pre-shared key if use of said key has been
>> stopped, but TLS session based on the key remain active.)

> With DHE_PSK, a passive eavesdropper doesn't get the information
> required for a dictionary attack against the PSK.
> 
> So it might be useful even with NULL encryption in some environments
> (where active MitM is not considered a significant threat, and the PSK
> is not guaranteed to be "strong enough"). I'm not sure how common
> those environments would be, but then again, I didn't think that
> anyone would want NULL encryption either...

OK, DHE_PSK can help for low-entropy passwords -- which you shouldn't
use, but which we shouldn't rely on not being used, I guess.  This
makes sense, but warrants explanation in the Security Considerations
section.  The Security Considerations ought to point out that

- DHE_PSK helps only if RSA_PSK and plain PSK ciphersuites are
  disabled (otherwise the adversary needs only a single connection
  attempt from a client to a rogue server to get data for a dictionary
  attack), and

- small subgroup attack countermeasures are required even though there
  is no DH key reuse.

  RFC 4346 mentions small-subgroup attacks, but only says that the
  need to be prevented when "the same DH keypair is to be used to
  prevent small subgroup attacks".  This makes sense for DH as used in
  the usual TLS ciphersuites, but the DHE ciphersuites from RFC 4279
  have stronger requirements if they are to be used as a dictionary
  attack countermeasure.  If the client does not check for small
  subgroups, then a single connection attempt to a rogue server can
  provide the server with the data needed for a dictionary attack,
  essentially like in plain PSK ciphersuites.  

This (at least the latter) is actually a bug report for RFC 4279, not
just for the new I-D.

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls