Re: [tram] Eric Rescorla's Discuss on draft-ietf-tram-stunbis-16: (with DISCUSS and COMMENT)

[Benjamin Kaduk <[e-mail]>]

On Fri, May 18, 2018 at 09:43:44AM -0400, Brandon Williams wrote:
> OK, so based on this, it seems that the WG was right about the desire to 
> move away from MD5 but unclear about the reason. If the goal is to 
> mitigate against keeping weak hashes in a local database on the server, 
> the doc should be clear that this is risk and explain how bid-down helps 
> achieve the goal.
> 
> Depending upon the internal implementation on the server, bid-down 
> protection could be important as part of a model to help the server 
> avoid caching weak precomputed password hashes to insecure local storage 
> I suppose. For example, if the server computes the hash using the 
> negotiated algorithm and then writes the hash to a local cache to avoid 
> having to calculate it again, it would be good to avoid generating weak 
> hashes that could be leaked from a compromised server. Of course, this 
> is only really meaningful if the server has strong protections around 
> the the username/password database that's required to generate the hash 
> values in the first place.
> 
> Does this seem like it would be going in the right direction?

I think so.

-Benjamin