Re: [TLS] I-D Action: draft-ietf-tls-pwd-04.txt

[Nico Williams <[e-mail]>]

On Tue, Apr 01, 2014 at 01:59:09PM -0700, Dan Harkins wrote:
> On Tue, April 1, 2014 12:30 pm, Nico Williams wrote:
> > On Fri, Mar 28, 2014 at 8:40 PM, Watson Ladd <[e-mail]>
> > wrote:
> >> PSK has no security? That's ridiculous: if high-entropy keys are used
> >> it is fairly easy to see it is secure.
> >
> > TLS-PSK did not specify a PBKDF either, so it can't be used with
> > passwords, therefore we might as well assume high-quality keys for
> > TLS-PSK.  Therefore you're quite right.
> 
>   There is nothing in the protocol that prevents it from being used with
> passwords. You're not only assuming something about the nature of the
> PSK, you're assuming something about the people that use the protocol
> and that is quite naive.

PSK requires pre-sharing the secret key.  If such presharing involves a
password then the secret key must be derived from said password.  How?
Well, the two peers have to agree.  How?  Well, it's not specified!

If there interoperable TLS-PSK w/ password implementations, then there's
a missing standard.  I have no knowledge of such implementations.

Without any further input the only reasonable conclusion is that TLS-PSK
does not support passwords.  Evidence to the contrary would be welcomed.

>   Furthermore making assumptions about the nature of the PSK does not
> change the fact that TLS-PSK has a defect: the advantage an attacker
> gains is through computation and not interaction. And for the non-DHE
> ciphersuites, that defect can be exploited through passive attack!

Only if they are password-derived keys, otherwise no.

> > Even if the server must store a password-equivalent I'd still want a
> > decent PBKDF to be used for any protocol that derives keying material
> > from passwords!
> 
>   Why? Deterministically hashing a secret 1000 times or 4000 times
> does not increase the entropy in the secret. A PBKDF is just supposed
> to increase the work factor of the attacker, it does nothing to the
> resulting keying material.

Because verifier databases get compromised regularly.  Just point your
browser to your favorite news site and wait a few weeks, you'll see.

>   Wi-Fi specifies a PBKDF when using a PSK and the exchange is
> essentially the same as the non-DHE TLS-PSK ciphersuites. That
> protocol is horribly broken and tools exist on the Internet to attack
> it. And guess what? People still use it with weak, low-entropy PSKs
> in spite of assumptions to the contrary.

My concern is not eavesdroppers in this case.  See above.

Nico
--