Re: [TLS] User Defined Key Pair

["OMAR HASSAN (RIT Student)" <[e-mail]>]

Hi Rich,

The security implications is not in the predictably generation of the key
pair, but in the seed length that you will be used to generate the key
pair, in other words it's a matter of it's sustainability against the brute
force attack.

That's why I mentioned three versions of the generate key function,
starting from generating the key pair based on the username, password, and
security question answer pair, and up to having a smart card, or hardware
token that has large enough random seed that will work with the username
and the password as a second factor authentication.

Even in the first case the password must be complex enough, and the each
security question must be follow the best practice of having thousands of
answer for each question, and remember that the question is not leaving the
browser, so the man in the middle attacker will have to try all questions
with all answers.



On Mon, Jun 24, 2013 at 7:33 PM, Salz, Rich <[e-mail]> wrote:

> **Ø  **On the browser level there should be a plugin that has a function
> to generate the key pair, that function must generate the same key pair for
> the same input parameters.****
>
> ** **
>
> That’s interesting.  This is the first system I’ve heard of that
> predictably generating a keypair is not only a feature, but a requirement.
> ****
>
> ** **
>
> I’m sure that I am not the only person who is bothered by the security
> implications of this.****
>
> ** **
>
>                 /r$****
>
> --  ****
>
> Principal Security Engineer****
>
> Akamai Technology****
>
> Cambridge, MA****
>