Re: [TLS] about the PWD Proposal

[Yoav Nir <[e-mail]>]

Hi

On Nov 18, 2011, at 9:59 AM, <[e-mail]> <[e-mail]> wrote:

> 
> Hi, 
>  I am interested in the PWD proposal at the meeting, and run through it(http://tools.ietf.org/html/draft-harkins-tls-pwd-01#section-3.4), 
>  and have the following concerns: 
> 
> 1. In the document, it  says both Client and Server should be able to compute PE, which is derived from username, password, salt,etc. 
>    That means Client or the user should also remember the salt value, in that case, salt is meaningless and can be replaced by a longer password. 
>    This is quite different from the widely known usage of salt, e.g. in UNIX operating system, salt is not required to remember by the user, but by server to fetch locally by reference to the username. 
>   And as far as I know, I am sure the authors also know that, other password based key exchanges protocols don't involve salt, but store a hash value of password among other things locally. 

I realize that this is very different from the usage in UNIX operating systems, but it is necessary, as the UNIX (or other) operating system running the web server has to store the password. Storing the password in the clear on as an unsalted hash is worse than storing a salted hash (or "base" in the draft's terminology), so that is what the TLS server does. The use of base instead of password is not to protect the password during handshake, but to protect it during storage on the server.

Having said that, I think it is now very practical to take a list of the 100,000 most popular passwords on the web, a database of 10,000 salted hashes (the file described in section 3.4), and find all the matches. That's 1,000,000,000 operations, which would take 15 minutes on a MacBook Air (1.4 GHz). I think the days of saying that a database of salted hashes makes theft of the password file irrelevant should be over. Yes, I know that with unsalted hash it would be practical to test the 100,000,000 most popular passwords. 

<snip/>
> 
> Sujing Zhou   
>   
> --------------------------------------------------------
> ZTE Information Security Notice: The information contained in this mail is solely property of the sender's organization. This mail communication is confidential. Recipients named above are obligated to maintain secrecy and are not permitted to disclose the contents of this communication to others.
> This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the originator of the message. Any views expressed in this message are those of the individual sender.

One more thing: I realize that the above line was probably inserted either by your MUA or MTA, but it is not true. Email messages to IETF mailing lists are considered contributions, and are subject to "Note Well" http://www.ietf.org/about/note-well.html

Yoav