Re: [TLS] one time passwords from private keys

[Story Henry <[e-mail]>]

On 28 Feb 2010, at 18:36, Adam Langley wrote:

> On Sun, Feb 28, 2010 at 11:58 AM, Story Henry <[e-mail]> wrote:
>> Yes, but I think that would make for a string that would be too long for a human being to type into a password field. Such a string should not be more than 5 to 6 characters long.
> 
> If we assume that the public key is widely known, then an attacker
> knows all the information that the legitimate authenticator knows.
> Thus the attacker can brute force the password offline, in real time.

> A six character password is, roughly, 30-bits.
> Assuming a 1024-bit
> modulus a desktop computer can probably do 2**18 public
> operations/sec. A hardware implementation might 100x faster. So it
> doesn't take much to brute force that in seconds - faster than you can
> expire the nonce because user's only type so quickly.

That is frighteningly fast. 
How many chars does one need then?
And how do 1 time passwords work then at all?

So I suppose the above would not be possible if the client can connect to
the server using https. Most browsers, even when they have broken client
side certificates, do allow https connections - I am guessing this is even true on cell phones. And the server could just tie the response to the TLS session. Does that not remove the above problem?

> 
>>  But to help people who are stuck in bad browser land, we are trying to work on this solution, which won't be any worse than username/passwords - in fact it should be more secure, whilst hopefully giving one one username/passowrd function for all sites.
> 
> We're aware that Google Chrome is certainly lacking in these respects
> on some platforms. It's on the todo list and not too far down.

Great. Also it would be fantastic if one could get the Android platform to support <keygen> and have a good key chain.

A year ago, I had an amazing demo on the iPhone. I could log into to a few of our demo sites without having to type either a username or a password. Pictures of this here:

   http://blogs.sun.com/bblfish/entry/one_click_global_sign_on

But somehow in v3 of the iPhone OS they broke their client certificate stack, and it no longer worked. 

   Henry


> 
> 
> AGL
> 
> -- 
> Adam Langley [e-mail] http://www.imperialviolet.org