Subject: [TLS] TLS-PWD vs. TLS-SRP

From: SeongHan Shin <[email-masked]>
Date: Thu, 7 Nov 2013 05:15:07 +0900

Hi all,

The TLS WG is about to issue a LC for tls-pwd.
http://tools.ietf.org/html/draft-ietf-tls-pwd-01

Is there any advantages of tls-pwd over tls-srp?
http://www.ietf.org/mail-archive/web/tls/current/msg09693.html

If anything I've missed, let me know.

Sincerely,
Shin

-- 
------------------------------------------------------------------
SeongHan Shin
Research Institute for Secure Systems (RISEC),
National Institute of Advanced Industrial Science and Technology (AIST),
Central 2, 1-1-1, Umezono, Tsukuba City, Ibaraki 305-8568 Japan
Tel : +81-29-861-2670/5284
Fax : +81-29-861-5285
E-mail : [email-masked]
------------------------------------------------------------------

---

From: "Dan Harkins" <[email-masked]>
Date: Wed, 6 Nov 2013 13:02:08 -0800 (PST)

Hi Shin,

> Is there any advantages of tls-pwd over tls-srp?

  TLS-srp binds the password to a particular finite cyclic group
and the user must use that group for the life of the password.
TLS-pwd does not do this. With TLS-pwd you use the existing
TLS mechanisms to select any of the existing FFC or ECC groups
to use (and when new groups get defined they will automatically
work). By divorcing the key generation parameters from the
password it also allows for more consistent cipher suite plus
group establishment-- e.g. use the brainpoolP256 group with
SHA256 and AES-128-- to establish a certain security level
for the connection.

  regards,

  Dan.

---

From: SeongHan Shin <[email-masked]>
Date: Thu, 7 Nov 2013 06:24:00 +0900

Hi Dan,

Here comes the next question:
Is there any advantages of tls-pwd over tls-augpake and SPEKE?
https://tools.ietf.org/html/draft-shin-tls-augpake-01
http://en.wikipedia.org/wiki/SPEKE_%28cryptography%29

Regards,
Shin

---

From: Fabrice <[email-masked]>
Date: Wed, 6 Nov 2013 13:43:36 -0800

> On Nov 6, 2013, at 13:02, "Dan Harkins" <[email-masked]> wrote:
> 
> 
>  Hi Shin,
> 

Isn't that required for every protocol that only stores a verifier on the server, rather than a password equivalent?

My understanding of TLS-PWD is that the server need to store a password equivalent (called the "base" in the TLS-PWD drafts), and as such does not have some of the desirable properties of SRP (or AugPAKE) related to server compromises.

  Fabrice

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: "Dan Harkins" <[email-masked]>
Date: Wed, 6 Nov 2013 14:29:46 -0800 (PST)

On Wed, November 6, 2013 1:43 pm, Fabrice wrote:
> Isn't that required for every protocol that only stores a verifier on the
> server, rather than a password equivalent?
>
> My understanding of TLS-PWD is that the server need to store a password
> equivalent (called the "base" in the TLS-PWD drafts), and as such does not
> have some of the desirable properties of SRP (or AugPAKE) related to
> server compromises.

  Your understanding is correct. There are drawbacks with the "desirable
properties" of both TLS-srp and TLS-pwd. Now you have a choice based on
what you value more.

  Dan.

---

From: "Dan Harkins" <[email-masked]>
Date: Wed, 6 Nov 2013 14:32:11 -0800 (PST)

Hi Shin,

> http://en.wikipedia.org/wiki/SPEKE_%28cryptography%29

  Mrs. Harkins didn't raise a moron. I really do not want to
repeat the debacle that occurred on the IPsec mailing list
regarding PAKE schemes.

  If you would like to rehash all those exchanges I suggest
you go look at the archives.

  regards,

  Dan.

---

From: SeongHan Shin <[email-masked]>
Date: Thu, 7 Nov 2013 07:36:34 +0900

FYI
AugPAKE can be implemented over any dl/ec groups and it provides resistance
to server compromise (like SRP).

Regards,
Shin

---

From: SeongHan Shin <[email-masked]>
Date: Thu, 7 Nov 2013 07:44:11 +0900

Hi Dan,

I also was in the IPsec mailing list through all discussions of PAKE
schemes.
But, I don't remember any advantages of pwd over augpake and speke.
Do you mean patent issue that pwd is patent-free and speke isn't?

Regards,
Shin

---

From: SeongHan Shin <[email-masked]>
Date: Thu, 7 Nov 2013 10:15:04 +0900

Dear all,

> Is there any advantages of tls-pwd over tls-augpake and SPEKE?
These are clarifying questions because TLS WG is going with PWD towards
"standard RFC" though PWD has no provable security and is less efficient
(compared to SPEKE and AugPAKE).
Are all tls wg members already clarified with advantages of using tls-pwd?
If so, just let me know.

For patent issues between SPEKE and PWD, there was no conclusions in the
earlier IPsec meetings to my understanding.

Best regards,
Shin