Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd

[Trevor Perrin <[e-mail]>]

On Tue, Dec 3, 2013 at 12:27 AM, Dan Harkins <[e-mail]> wrote:
>
>   Dear Rene,
>
> On Mon, December 2, 2013 6:28 am, Rene Struik wrote:
>> Dear colleagues:
>>
>> I had a look at draft-ietf-tls-pwd-02. While I do appreciate the work
>> that went into this draft, I have to concur with some other commenters
>> (e.g., Doug Stebila, Bodo Moeller) that it is unclear what makes this
>> protocol special compared to other contenders, both in terms of
>> performance and detailed cryptanalysis. One glaring omission is detailed
>> security evidence, which is currently lacking (cross-referencing some
>> other standards that have specified the protocol does not by itself
>> imply the protocol is therefore secure). I am kind of curious what
>> technical advantages the "Dragonfly" protocol has over protocols that
>> seem to have efficiency, detailed and crypto community reviewed
>> evidence, such as, e.g., AugPAKE (which is another TLS-aimed draft) and
>> others. So, if the TLS WG has considered a feature comparison, that
>> would be good to share.
>
>   dragonfly is a balanced PAKE kind of exchange and it has certain
> advantages over augmented PAKE schemes like TLS-SRP

Wait, what?

"Augmented PAKE" is of course better than "Balanced PAKE", as it
allows the server to store non-usable credentials.

TLS already has an "Augmented PAKE" - TLS/SRP (RFC 5054) which is
implemented in OpenSSL and elsewhere.

It's not used on the web, or widely, as the TLS layer is generally the
wrong place for user authentication (e.g. leaks username, terminated
at front-end machines without access to user credentials, etc).

However, what little demand exists for a TLS PAKE seems like it's
being adequately served by TLS-SRP.

Why is the WG considering another PAKE with worse properties (non-augmented)?


Trevor