Re: [TLS] draft on new TLS key exchange

[Marsh Ray <[e-mail]>]

On 10/06/2011 02:06 PM, Martin Rex wrote:
>>
>> Marsh Ray wrote:
>>>
>>> Couldn't an attacker observe the timings of a sufficient number of
>>> failed handshakes to enable an offline brute force attack on the
>>> low-entropy password?
>
> I agree with Marsh, it is difficult to conceive how to implement
> this without being a timing oracle.

I disagree with Martin. :-)

It probably could be implemented without being a timing oracle, but 
blinding the timing channel might impose something approximating 
worst-case latency in all cases. Without benchmarking, I don't know if 
that means microseconds or milliseconds.

But mainly the fix wouldn't happen by accident. It needs to be pointed 
out with a high profile in the security considerations section.

> The question is, how much does it help you.
>
> If you already have an account or could create one, then the timing
> would help you sort out unlikely passwords, I assume, because you
> know the algorithm and can determine "off-line" whether a computation
> for a newly guessed password is faster or slower than your own password
> and you can measure the servers response times for your password and
> for the unknown password and therefore know their relation.

Collect timing on a few thousand handshakes for a given user. Observe 
the server response time clustering into buckets with a log_2 decaying 
distribution.

> I don't find it very attractive if an authentication protocol gives
> an attacker a huge advantage at guessing an unknown account credential
> if he can create or obtain a valid account credential.

I don't think it requires the attacker to obtain an account on the same 
server (but even if it did, that would still be bad).

> I also feel very uncomforable with the extremely vague term
> "low-entropy password" and the idea that this could be secure.

Sometimes we have to make the best of what we've got. Maybe sometimes 
all we've got is a password.

Still, I'm skeptical about who would use this thing and that they 
wouldn't be better served with something else.

> If the whole handshake takes 1 second to complete (or fail), then
> a brute force of the entire 2^13.28 entropy universe completes
> in less than 3 hours.  Without a lockout, there just is not any
> meaningful security possible.

Consider a "smart grid" of electric meters with a service lifetime of 30 
years. The meters probably have very slow CPUs making timing values 
relatively large and easy to distinguish. They may handshake regularly 
with the controlling systems. The power line network is about as open 
and undefended as you can get.

An attacker may be able to gather timing statistics for several years, 
after which he has obtained complete "blinkenlights capability" over the 
service region. That would be bad.

- Marsh