Subject: [kitten] SPAKE pa-hint

From: Greg Hudson <[email-masked]>
Date: Tue, 06 Feb 2018 20:15:26 -0500

Candidate draft changes here:
https://github.com/greghudson/ietf/pull/5/files

For convenience, here is the proposed text.  Keep in mind that (as far
as I know) no one currently implements RFC 6113 authentication sets, so
implementations will generally ignore the new section for the time
being.

10.  Hint for Authentication Sets

   If a KDC offers SPAKE pre-authentication as part of an authentication
   set ([RFC6113] section 5.3), it MAY provide a pa-hint value
   containing the DER encoding of the ASN.1 type PA-SPAKE-HINT, to help
   the client determine whether SPAKE pre-authentication is likely to
   succeed if the authentication set is chosen.

   PA-SPAKE-HINT ::= SEQUENCE {
       groups      [0] SEQUENCE (SIZE(1..MAX)) OF Int32,
       factors     [1] SEQUENCE (SIZE(1..MAX)) OF SPAKESecondFactor
   }

   The groups field indicates the KDC's supported groups.  The factors
   field indicates the KDC's supported second factors.  The KDC MAY omit
   the data field of values in the factors list.

   A KDC MUST NOT include a PA-SPAKE-HINT message in a pa-value field;
   hints must only be provided within authentication sets.  A KDC SHOULD
   include a hint if SPAKE pre-authentication is offered as the second
   or later element of an authentication set.

   The PA-SPAKE-HINT message is not part of the transcript, and does not
   replace any part of the SPAKE message flow.

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 8 Feb 2018 20:21:36 -0600

>        factors     [1] SEQUENCE (SIZE(1..MAX)) OF SPAKESecondFactor

Do we need to repeat and/or modify the security considerations text
about unauthenticated plaintext in the factors portion of a
challenge with respect to the pa-hint contents?

-Ben

> _______________________________________________
> Kitten mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/kitten

---

From: Greg Hudson <[email-masked]>
Date: Fri, 9 Feb 2018 00:31:21 -0500

On 02/08/2018 09:21 PM, Benjamin Kaduk wrote:> Do we need to repeat
and/or modify the security considerations text
> challenge with respect to the pa-hint contents?

Proposed text, adding a fourth paragraph to the unauthenticated
plaintext subsection:

    Unless FAST is used, any PA-SPAKE-HINT messages included when SPAKE
    is advertised in authentication sets are unauthenticated, and are not
    protected by the transcript hash.  Since hints do not replace any
    part of the message flow, manipulation of hint messages can only
    affect the client's decision to use or not use an authentication set,
    which could more easily be accomplished by removing authentication
    sets entirely.

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 9 Feb 2018 12:11:54 -0600

>     which could more easily be accomplished by removing authentication

Sounds good.  Thanks!

-Ben