[TLS] is it good using password for authentication only?

["Bingzheng Wu" <[e-mail]>]

Hi all,

I have a question about authentication and key-exchange.

TLS 1.3 removes RSA and DH static key-exchange, which mixs authentication
and key-exchange together.
However there are some PAKE models for TLS, e.g. RFC 5054 and 2 drafts.
I think that PAKE mixs them together too.

Which is better, mixing them together, or keeping them independent to each other?
Is it possible to use password for authentication only?


Here is a example handshake flow for password-based authentication:

  ClientHello
  ClientKeyshare  -->
                          ServerHello
                          ServerKeyshare
                          PasswordVerify
                     <--  Finished
  PasswordVerify
  Finished       -->

where:

  ClientHello takes an extension to carry username.

  PasswordVerify takes the verifier based on password, which could be:
      HASH(username, passward, handshake_message_hash, label)
      where handshake_message_hash is defined in TLS 1.3,
      and label is "TLS 1.3, server PasswordVerify" or "TLS 1.3, client
      PasswordVerify".

  and other messages keep the same with TLS 1.3.


This could work with Certificate authentication together, by server adding
Certificate and CertificateVerify messages following PasswordVerify, and
client verifying them both.


Is this ok?

I think this makes it easier to merge passward-based authentication into TLS 1.3.


Thanks in advance,
Bingzheng Wu