Subject: [TLS] is it good using password for authentication only?

From: "Bingzheng Wu" <[email-masked]>
Date: Thu, 18 Jun 2015 11:07:34 +0800

Hi all,

I have a question about authentication and key-exchange.

TLS 1.3 removes RSA and DH static key-exchange, which mixs authentication
and key-exchange together.
However there are some PAKE models for TLS, e.g. RFC 5054 and 2 drafts.
I think that PAKE mixs them together too.

Which is better, mixing them together, or keeping them independent to each other?
Is it possible to use password for authentication only?

Here is a example handshake flow for password-based authentication:

  ClientHello
  ClientKeyshare  -->
                          ServerHello
                          ServerKeyshare
                          PasswordVerify
                     <--  Finished
  PasswordVerify
  Finished       -->

where:

  ClientHello takes an extension to carry username.

  PasswordVerify takes the verifier based on password, which could be:
      HASH(username, passward, handshake_message_hash, label)
      where handshake_message_hash is defined in TLS 1.3,
      and label is "TLS 1.3, server PasswordVerify" or "TLS 1.3, client
      PasswordVerify".

  and other messages keep the same with TLS 1.3.

This could work with Certificate authentication together, by server adding
Certificate and CertificateVerify messages following PasswordVerify, and
client verifying them both.

Is this ok?

I think this makes it easier to merge passward-based authentication into TLS 1.3.

Thanks in advance,
Bingzheng Wu

---

From: "Bingzheng Wu" <[email-masked]>
Date: Fri, 19 Jun 2015 16:19:38 +0800

Maybe I realize the problem. The PasswordVerify message is susceptible to
offline dictionary attacks.

Dose it become resistant to the attack if we add some secret generated from
master-secret into the HASH?

  PasswordVerify = HASH(username, passward, handshake_message_hash,
master-secret, label)

This becomes involved with key-exchange, but it is not involved with any
specific key-exchange method.
It just need the key-exchange result.

Bingzheng

> -----Original Message-----
> From: TLS [mailto:[email-masked]] On Behalf Of Bingzheng Wu
> Sent: Thursday, June 18, 2015 11:08 AM
> To: tls
> Subject: [TLS] is it good using password for authentication only?
> 
> Hi all,
> 
client
> verifying them both.
> 
> 
> Is this ok?
> 
> I think this makes it easier to merge passward-based authentication into
TLS
> 1.3.
> 
> 
> Thanks in advance,
> Bingzheng Wu
> 
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: "Bingzheng Wu" <[email-masked]>
Date: Fri, 19 Jun 2015 19:03:02 +0800

I am wrong again. Adding master-secret is useless.

Now I think that asymmetric crypto must be used to prevent offline directory attack, which is the way PAKE works as.

Sorry for disturbing.

------------------------------------------------------------------
From:武炳正(允中) <[email-masked]>
Time:2015 Jun 19 (Fri) 16:19
To:武炳正(允中) <[email-masked]>, tls <[email-masked]>
Subject:RE: [TLS] is it good using password for authentication only?

Bingzheng