From: Laura Bauman <l_bauman@apple.com>
Message-id: <576FC1C2-BC06-4ABC-A98E-6AB363AB31A1@apple.com>
Content-type: multipart/alternative;
 boundary="Apple-Mail=_C991BBC5-B7DB-4642-A2E4-AA1B5F356A9F"
MIME-version: 1.0 (Mac OS X Mail 16.0 \(3826.300.87.4.3\))
Date: Tue, 18 Mar 2025 09:23:24 +0700
In-reply-to: 
 <CAChr6Szz2HS71x2DnekY3Os4LaNEJs704rgSjRhVL9z_VF43jg@mail.gmail.com>
To: Rob Sayre <sayrer@gmail.com>
References: <05B28816-9AA9-4035-B451-8ACFFBE2D4DE@apple.com>
 <CAChr6Sy1Eew1J5z9at3qEwLRWn+7ZLm0f564LobNQGMD7ANQaA@mail.gmail.com>
 <CABcZeBOpk2cYAyie4=G5=c6V43HvGB70fKVf_e_bQqnt_4C9WQ@mail.gmail.com>
 <CAF8qwaAoYEZj_t56unUAqz+SaKw6CvMFJ2NmqNmE8skmjKKSpA@mail.gmail.com>
 <CAChr6Sw+9bZxjcaJMNbY8UZBbmv5ZDnyb7aGtCjXcrtxvfeoew@mail.gmail.com>
 <CABcZeBNFPLWcYDhv1axqSwTX_w_yatfbJyih8CUMhZfkK5484g@mail.gmail.com>
 <CAChr6Syji7TKs6GumtmpZ8_tKXb5UK10_b6HdR1PU8Oni0pTkw@mail.gmail.com>
 <CABcZeBOHSGBOj_4R0bVdCpaRTcVV6=uHOzvWcY9HFei7PbC1fw@mail.gmail.com>
 <CAChr6SxFNN4wH=45HANWuFZVX8_2HfX14mS2WayVSe_ide2RWg@mail.gmail.com>
 <CAChr6Szz2HS71x2DnekY3Os4LaNEJs704rgSjRhVL9z_VF43jg@mail.gmail.com>
Message-ID-Hash: SDNIFFP5LDSKN3METBNYYD3AGYJVRY6D
CC: tls@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BTLS=5D_Re=3A_Feedback_on_draft-bmw-tls-pake13-01=2Etxt?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/tls/meIVhMlSFSf71wZ5MZsvW-_5PAU>


--Apple-Mail=_C991BBC5-B7DB-4642-A2E4-AA1B5F356A9F
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8


> On Mar 18, 2025, at 1:44=E2=80=AFAM, Rob Sayre <sayrer@gmail.com> =
wrote:
>=20
> On Mon, Mar 17, 2025 at 10:02=E2=80=AFAM Rob Sayre <sayrer@gmail.com =
<mailto:sayrer@gmail.com>> wrote:
>> On Mon, Mar 17, 2025 at 9:38=E2=80=AFAM Eric Rescorla <ekr@rtfm.com =
<mailto:ekr@rtfm.com>> wrote:
>>>=20
>>> As above, I don't see what this has to do with PAKEs at all. If you =
have a third
>>> party authentication system, whether sign in with Apple, Google, or =
some SSO
>>> provider, then you don't need to share any secret with the relying =
party.
>>=20
>> In my mind, the idea is that you don't have to rely solely on WebPKI =
if you have that information handy after registration.
>=20
> The other PAKE draft on the agenda explains this motivation better in =
its introduction, although the mechanism is different:
>=20
> =
https://www.ietf.org/archive/id/draft-guo-pake-pha-tls-01.html#name-introd=
uction
>=20
> In draft-bmw-tls-pake13-01, the words "such as" are doing a lot of =
work in the abstract and introduction. I doubt they are aiming at =
passwords that a user types, given all of their other efforts to ditch =
passwords, but idk.


Our usage of =E2=80=9Cpassword=E2=80=9D in the abstract/introduction =
appears to be a bit misleading. There is a disconnect between the term =
password (as in P(assword)AKE) and what we view as the motivating use =
cases for this mechanism, namely:

1. One time connections with no need for a long term authentication =
credentials (e.g. screen casting, video conferencing equipment)
2. An initial connection over which high entropy long term credentials =
(e.g. external PSK, RPKs) can be exchanged (e.g. pairing, device setup)

In these cases, the =E2=80=9Cpassword=E2=80=9D is more likely to be a =
passcode/pin or otherwise temporary low entropy secret. We are not =
aiming to provide a solution or alternative for web login use cases or =
advocating for users to need to enter passwords more places.=

--Apple-Mail=_C991BBC5-B7DB-4642-A2E4-AA1B5F356A9F
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><head><meta http-equiv=3D"content-type" content=3D"text/html; =
charset=3Dutf-8"></head><body style=3D"overflow-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: =
after-white-space;"><br><div><blockquote type=3D"cite"><div>On Mar 18, =
2025, at 1:44=E2=80=AFAM, Rob Sayre &lt;sayrer@gmail.com&gt; =
wrote:</div><br class=3D"Apple-interchange-newline"><div><div =
dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">On Mon, Mar 17, 2025 at =
10:02=E2=80=AFAM Rob Sayre &lt;<a href=3D"mailto:sayrer@gmail.com" =
target=3D"_blank">sayrer@gmail.com</a>&gt; wrote:</div><div =
class=3D"gmail_quote"><blockquote class=3D"gmail_quote" =
style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid =
rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div dir=3D"ltr">On =
Mon, Mar 17, 2025 at 9:38=E2=80=AFAM Eric Rescorla &lt;<a =
href=3D"mailto:ekr@rtfm.com" target=3D"_blank">ekr@rtfm.com</a>&gt; =
wrote:<br></div><div class=3D"gmail_quote"><blockquote =
class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px =
solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div =
class=3D"gmail_quote"><div><br></div>As above, I don't see what this has =
to do with PAKEs at all. If you have a third</div><div =
class=3D"gmail_quote">party authentication system, whether sign in with =
Apple, Google, or some SSO</div><div class=3D"gmail_quote">provider, =
then you don't need to share any secret with the relying =
party.</div></div></blockquote><div><br></div><div>In my mind, the idea =
is that you don't have to rely solely on WebPKI if you have that =
information handy after =
registration.</div></div></div></blockquote><div><br></div><div>The =
other PAKE draft on the agenda explains this motivation better in its =
introduction, although the mechanism is =
different:</div><div><br></div><div><a =
href=3D"https://www.ietf.org/archive/id/draft-guo-pake-pha-tls-01.html#nam=
e-introduction" =
target=3D"_blank">https://www.ietf.org/archive/id/draft-guo-pake-pha-tls-0=
1.html#name-introduction</a></div><div><br></div><div>In =
draft-bmw-tls-pake13-01, the words "such as" are doing a lot of work in =
the abstract and introduction. I doubt they are aiming at passwords that =
a user types, given all of their other efforts to ditch passwords, but =
idk.</div></div></div>
</div>
</div></blockquote></div><div><br></div><div>Our usage of =E2=80=9Cpasswor=
d=E2=80=9D in the abstract/introduction appears to be a bit misleading. =
There is a disconnect between the term password (as in P(assword)AKE) =
and what we view as the motivating use cases for this mechanism, =
namely:</div><div><br></div><div>1. One time connections with no need =
for a long term authentication credentials (e.g. screen casting, video =
conferencing equipment)</div><div>2. An initial connection over which =
high entropy long term credentials (e.g. external PSK, RPKs) can be =
exchanged (e.g. pairing, device setup)</div><div><br></div><div>In these =
cases, the =E2=80=9Cpassword=E2=80=9D is more likely to be a =
passcode/pin or otherwise temporary low entropy secret. We are not =
aiming to provide a solution or alternative for web login use cases or =
advocating for users to need to enter passwords more =
places.</div></body></html>=

--Apple-Mail=_C991BBC5-B7DB-4642-A2E4-AA1B5F356A9F--