Subject: EAP-SRP Challenge

From: Lauri Tarkkala <[email-masked]>
Date: Mon, 5 Nov 2001 18:44:51 +0200

Some comments on the document "draft-ietf-pppext-eap-srp-03.txt".

The document defines that the client in an EAP SRP
exchange verify the group and generator are sufficient for providing
protection for the secret x, where x is
SHA1(<salt> || SHA1(<name> || ":" || <secret>)).

The authenticator provides the prime modulus N and the generator
g.  The client must then check that "N" is prime and then it
must attempt to ensure that "g" is a generator of the group
and not of a sub-group of N.

This can be done easily IF "N" is a safe prime (s.t. N=2p+1 and p
is prime), in which case the order (q) of g must be either N-1, 2 or (N-1)/2.

I assume that this is the intended meaning of the specification, but
I would like to see it stated explicitly that the modulus must
be a safe prime (RFC2945 states that N should be a safe prime (note
"should" is used instead of the designated "SHOULD" keyword)).

This would prevent sloppily written implementations from failing to
interoperate with clients which actually attempt to verify that "g"
is a generator of group Z_N.

Since discovering the order of an element in a group is a hard problem
I see no reason for providing the "additional" generality by assuming
that the client can use some arbitrary algorithm for deciding whether
a group is ok or not.

>   The authenticatee MUST validate that the specified generator value is
>   indeed a generator modulo N, as described in the SRP documentation
>   [SRP].  In many cases, an efficient method to do this is to keep a
>   list of known-good values, and compare against this list.  Since the
>   full validation procedure is complex, the authenticator SHOULD use a
>   longer timeout value if the default generator and modulus are not
>   used; at least 30 seconds is RECOMMENDED.

This is insufficient.

Assuming that N is a safe-prime, then the client must perform two
primality checks for integers of e.g. 2048 bits. If the authenticator
is using either the Rabin-Miller or the Solovay-Strassen tests, this
can take upto several minutes on a client with "limited computational
resources" (depending obviously on the certainity one desires). I would recommend
raising the proposed limit to at least 150 seconds.

Lauri

-- 
Lauri Tarkkala
SSH Communications Security Corp