Re: [TLS] The PAKE question and PSK

["Dan Harkins" <[e-mail]>]

On Wed, April 2, 2014 10:26 am, Nico Williams wrote:
> On Wed, Apr 2, 2014 at 12:18 PM, Dan Harkins <[e-mail]> wrote:
>>   EKE doesn't do RSA. And, as Nico pointed out, observing a single
>> exchange
>> can eliminate a large majority of the potential passwords. Even an
>> infrequent
>> use can give an adversary a high probability of successfully determining
>> the secret.
>
> But if you use Elligator then that problem goes away.  That's the key
> point.

  Yes, as I mentioned back in December on this list, EKE with Elligator
would make a very good alternative to TLS-pwd. And if there was a mature
draft ready for publication that specified such a scheme it would be worth
considering. But there isn't. And we're 2+ years away from having such a
thing. Probably more since we have not identified a stuckee willing to
edit it.

  As Cullen mentioned, the IETF is a volunteer organization and telling
people that they should go write a draft specifying your alternative to
their draft is not really productive.

  I have received and resolved comments on the draft dealing with
protection of the username from passive observers and on mitigating
side channel attacks. There is no technical problem with TLS-pwd and it
solves real problems right now. I see no reason why it should not ease
away from the curb (and out of its parked position).

  regards,

  Dan.