Subject: Re: [TLS] is it good using password for authentication only?

From: Manuel Pegourie-Gonnard <[email-masked]>
Date: Sun, 19 Jul 2015 12:21:13 +0200

Hi,

On 6/19/15 13:03, Bingzheng Wu wrote:
> I am wrong again. Adding master-secret is useless.
>
> Now I think that asymmetric crypto must be used to prevent offline directory attack, which is the way PAKE works as.
>
I'm probably wrong since I only thought about it for a few minutes, but 
it seems to me that the PasswordVerify message would be encrypted with 
(keys derived from) the handshake master secret, which would prevent 
offline attacks.

What am I missing?

> Sorry for disturbing.
Probably sorry too :)

Manuel.

> ------------------------------------------------------------------
> From:武炳正(允中) <[email-masked]>
> Time:2015 Jun 19 (Fri) 16:19
> To:武炳正(允中) <[email-masked]>, tls <[email-masked]>
> Subject:RE: [TLS] is it good using password for authentication only?
>
> Maybe I realize the problem. The PasswordVerify message is susceptible to
> offline dictionary attacks.
>
> Dose it become resistant to the attack if we add some secret generated from
> master-secret into the HASH?
>
>    PasswordVerify = HASH(username, passward, handshake_message_hash,
> master-secret, label)
>
> This becomes involved with key-exchange, but it is not involved with any
> specific key-exchange method.
> It just need the key-exchange result.
>
>
> Bingzheng
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Thijs van Dijk <[email-masked]>
Date: Sun, 19 Jul 2015 12:42:22 +0200

Hi Manuel,

On 19 July 2015 at 12:21, Manuel Pegourie-Gonnard <[email-masked]> wrote:

> I'm probably wrong since I only thought about it for a few minutes, but it
> seems to me that the PasswordVerify message would be encrypted with (keys
> derived from) the handshake master secret, which would prevent offline
> attacks.
>
> What am I missing?

The key observation is the following: (I mentioned this off-list a few
weeks ago, but I guess I'll post it here as well for posterity.)

[T]he master secret will be derived from the client's and server's
> respective KeyShare messages, and will therefore be known at the time the
> server's PasswordVerify is sent. A malicious client could therefore perform
> half a handshake (just enough to get the server to give up its PV message),
> abort, and proceed with an offline attack in its own time.

I thought about switching the order in which server and client send their
> PV, but in much the same manner this won't protect clients from malicious
> servers.

-Thijs

---

From: Mike Hamburg <[email-masked]>
Date: Sun, 19 Jul 2015 10:36:17 -0700

Also, it isn't too difficult to implement a PAKE.  But there isn't a 
(known?) way to do it without adding rounds, if you want to protect the 
username.  This is because the server needs the username before it can 
do anything with the password.  Unless it has 0-RTT information the 
client can't encrypt the username before receiving the server's 
ephemeral share.  So you need at least

ClientHello ->
<- ServerKeyshare
PakeStuff ->
<- PasswordVerify
PasswordVerify, Finished ->

(With other messages in there too of course, but these ones limit the 
round count with PAKE.)

-- Mike

On 7/19/2015 3:42 AM, Thijs van Dijk wrote:
> Hi Manuel,
>
> On 19 July 2015 at 12:21, Manuel Pegourie-Gonnard <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     I'm probably wrong since I only thought about it for a few
>     minutes, but it seems to me that the PasswordVerify message would
>     be encrypted with (keys derived from) the handshake master secret,
>     which would prevent offline attacks.
>
>     What am I missing?
>
>
>     respective KeyShare messages, and will therefore be known at the
>     time the server's PasswordVerify is sent. A malicious client could
>     therefore perform half a handshake (just enough to get the server
>     to give up its PV message), abort, and proceed with an offline
>     attack in its own time. 
>
>     I thought about switching the order in which server and client
>     send their PV, but in much the same manner this won't protect
>     clients from malicious servers.
>
>
> -Thijs
>
>

---

From: Manuel Pegourie-Gonnard <[email-masked]>
Date: Sun, 19 Jul 2015 20:19:11 +0200

Hi Thijs,

>> abort, and proceed with an offline attack in its own time.

Indeed. Thanks!

(And sorry for the noise, as expected.)

Manuel.