Subject: RE: KISS for PKIX. (Was: RE:Asymmetric authentication

From: "Waters, Stephen" <[email-masked]>
Date: Wed, 21 Jul 1999 15:06:52 +0100

>> From: "Waters, Stephen" <[email-masked]>
>> 
>> As you say, if the Phase1 authentication is based on a poorly kept shared
>> (group) key, anything can happen without the need to acquire a device. I
>> don't see that a well chosen, unique, well secured pre-shared secret is
much
>> worse than a certificate though.

>If the user is going to have to remember and enter a well chosen, unique
>shared secret, then why shouldn't he just remember his private key and
>do away with XAUTH?

>A private key doesn't have to be kept in a PSE on the pilferable
>laptop, it could be typed when the user establishes a connection.
>A 160 bit private key is (only) 15 S/KEY words, at 11 bits per word.

>1/2 :-)

Sorry, should have been clearer. I was assuming that the user remembers a
reasonably short password/pin that is used to access the pre-shared secret,
much in the same way as Smartcards can require pin numbers before you can
use the private key stored on them.

Pre-shared secrets can be quite long - 128 characters? - 1024bits. Easier to
remember than an RSA key maybe, but still, could be too long to remember
without writing it down.

Steve.

---

From: Stephen Kent <[email-masked]>
Date: Wed, 21 Jul 1999 10:38:24 -0400

Stephen and David,

There is another approach here, that I first heard suggested by Jeff
Schiller a number of years ago. One could remember a pass phrase and use it
as the seed for a PRNG, which then feeds into a key pair selection
algorithm, thus recreating one's private key, rather than storing it. It
occurs to me that some additonal entropy could be provided by a second seed
value, saved in encrypted form and decrypted with the pass phrase.  because
this second value would be random (preferavly from a non-deterministic
source) attempts to decrypt it do not yield quick confirmation of gusses.
Instead, one has to try to use the pair of values (the pass phrase guess
and the decrypted second seed), to genreate a key pair, and then check to
see if the result yields the public key for the user. This approach is
clearly much, much slower that just decrypting a stored key, but it allows
a greater degree of security vs. a stored private key encrypted with a
password, and makes offline guessing attacks more costly.  Also, because
one hash complete freedom in choosing the pass phrase, it should be easier
to remember than a string of words formed from the bit pattern of a private
key.

Just a thought,

Steve