Re: [TLS] New cipher suites for SRP

[Hubert Kario <[e-mail]>]

On Monday 29 June 2015 10:05:53 Jeffrey Walton wrote:
> On Mon, Jun 29, 2015 at 9:57 AM, Hubert Kario <[e-mail]> wrote:
> > On Monday 29 June 2015 06:55:59 Tom Wu wrote:
> >> > +1, provided we do two more things:
> >> >  - Change the negotiation so that user name is not exchanged in the
> >> >  clear
> >> >  - Change key exchange to do PFS
> >> 
> >> SRP already provides PFS automatically.
> > 
> > I'm rather fuzzy about the details (I've read the RFC quite a bit ago),
> > but
> > isn't the server key share static in SRP?
> 
> No.
> 
> Here's the step that calls out its a random key (from RFC 5054):
> 
>     2.5.3.  Server Key Exchange
> 
>    The server key exchange message contains the prime (N), the generator
>    (g), and the salt value (s) read from the SRP password file based on
>    the user name (I) received in the client hello extension.
> 
>    The server key exchange message also contains the server's public
>    value (B).  The server calculates this value as B = k*v + g^b % N,
>    where b is a random number that SHOULD be at least 256 bits in length
>    and k = SHA1(N | PAD(g)).
> 
> Things like resumption can affect the forward secrecy, though. But all
> cipher suites suffer it equally.

ahh, I stand corrected, thanks

-- 
Regards,
Hubert Kario
Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic