Subject: [http-auth] My comments from today re:password security

From: Eric Rescorla <[email-masked]>
Date: Fri, 8 Nov 2013 09:15:56 -0800

As I was saying at the microphone, the point of a PAKE protocol is that you
don't need really high entropy passwords. Accordingly, our guidance should
look something like:

- Users should choose passwords that aren't trivially guessable.
   As a wild-ass guess this means something like 10^{5} or 10^{6} bits
   of entropy.

- Servers should have some sort of limited try capability to stop attackers
  from exhaustively searching low-entropy passwords. This is actually
  kinda tricky to avoid DoS attacks. Generally, you try to add delays
  that back off after failed password requests, not just lock out the
account.

- The server should use encryption to protect the password database.

Operationally, the protocol should probably be designed with a lot of
key stretching to make exhaustive offline search under
password database theft more difficult.

-Ekr

---

From: Yutaka OIWA <[email-masked]>
Date: Sat, 9 Nov 2013 02:27:28 +0900

Thank you for very well phrased, compact text.
I'd like to use these texts probably in the -02 draft or around.
More comments from people are still welcome.

> password database theft more difficult.

I am considering to incorporate PBKDF2 or some of similar things
as a key stretching mechanism, proposed by some people.
I personally think this is a right direction for the draft improvement.
It will replace current simple SHA256- (or SHA512-) based
generation of numerical password equivalent.

2013/11/9 Eric Rescorla <[email-masked]>

> As I was saying at the microphone, the point of a PAKE protocol is that
> you don't need really high entropy passwords. Accordingly, our guidance
> should look something like:
>
> _______________________________________________
> http-auth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/http-auth
>
>

-- 
Yutaka OIWA, Ph.D.                 Leader, System Life-cycle Research Group
                               Research Institute for Secure Systems (RISEC)
     National Institute of Advanced Industrial Science and Technology (AIST)
                       Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]

---

From: Ilari Liusvaara <[email-masked]>
Date: Fri, 8 Nov 2013 21:53:54 +0200

>    As a wild-ass guess this means something like 10^{5} or 10^{6} bits

You mean 10^5-10^6 choices (roughly 17-20 bits), right (10^5 bits of entropy
is kinda wild)? :-)

> - The server should use encryption to protect the password database.

You mean something like hashing or something else?

-Ilari

---

From: Michael Thomas <[email-masked]>
Date: Fri, 08 Nov 2013 12:02:04 -0800

> You mean 10^5-10^6 choices (roughly 17-20 bits), right (10^5 bits of entropy

I don't know if this is pertinent, but what people should do and do-do
are manifestly different. If anybody's positing that the  "should" will 
happen
as a prerequisite to something else... well, there should be the tooth 
fairy too.

Mike

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 8 Nov 2013 12:05:07 -0800

On Fri, Nov 8, 2013 at 11:53 AM, Ilari Liusvaara <
[email-masked]> wrote:

> you

Yeah. Long week at the standards factory.

> You mean something like hashing or something else?

No, I actually meant encryption at rest, because if you use low entropy
passwords then DB theft becomes a really serious risk. I know this is a
half measure...

-Ekr