Subject: Re: [TLS] PSK in 1.3?

From: Peter Gutmann <[email-masked]>
Date: Mon, 20 Oct 2014 20:00:59 +0000

Dan Harkins <[email-masked]> writes:

>There is nothing to flesh out because you seem to not understand what a
>dictionary attack is-- but you're in company because neither did the editors
>of that RFC.
>
>Protocols that use a static, symmetric credential like a PSK (or a password,
>the difference is semantic) are all flawed because the adversary is always
>assumed to have access to a pool from which the PSK (or password is drawn.

As Watson has already pointed out, the protocol name is "preshared key", not
"preshared password" as you seem to think.  I've been party to the deployment
of several PSK-based devices/systems, for which the pool from which the PSK is
drawn is well-known to an attacker, it ranges from 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 to FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF.  Since
I've now given you what you need to know, I'll let you go away and brute-force
the system.  Let us know when you're done.

Peter.

---

From: "Dan Harkins" <[email-masked]>
Date: Mon, 20 Oct 2014 13:34:38 -0700 (PDT)

> the system.  Let us know when you're done.

  Is that the "royal we"?

  And, you need to supply a bit more than that information to enable
a dictionary attack (such as the data that contains a hash of the PSK plus
other information known to the attacker). But you were making a sarcastic
point, not a technical point weren't you?

  The issue is not so much the range, it's which values in that range are
going to be valid PSKs and which are not. But, again, you were being
sarcastic so a technical response is somewhat unnecessary.

  And, yes, I did notice that Watson said that the RFC is "pre-shared key"
and not "pre-shared password" but, as I said (did you notice?), that is
merely a semantic difference. The ciphersuites are _completely oblivious_
to the type and quality of the credential they use. You can't claim the
_protocol_ is resistent to dictionary attack if the protocol can be used
in a manner that makes it susceptible to dictionary attack.

  I have witnessed, and sadly been party to, many deployments of PSK-based
devices/systems for which the pool that the PSK is drawn from is the same
pool as you describe above. Unfortunately, they did something like
PBKDF2(easy-to-enter-keystream) to generate this PSK, which is not a
"password", in this huge range. And I encourage you to search the
Internet for "coWPAtty" to get a nice tool to attack them. Of course, you
will need to also supply a tcpdump of the exchange but that's easy to
capture.

  regards,

  Dan.

---

From: Viktor Dukhovni <[email-masked]>
Date: Tue, 21 Oct 2014 16:02:47 +0000

On Mon, Oct 20, 2014 at 01:34:38PM -0700, Dan Harkins wrote:

> The ciphersuites are _completely oblivious_

No protocol is resistant to dictionary attack under the above
definition.

In TLS with DHE or ECDHE key agreement, the client's private exponent
may be drawn from the set "eeny, meeny, miny, moe" (suitably
encoded).  The server's secret may be drawn from "Chico, Harpo,
Groucho, Gummo, Zeppo".  Dictionary attack away!

-- 
	Viktor.

---

From: "Dan Harkins" <[email-masked]>
Date: Tue, 21 Oct 2014 11:45:48 -0700 (PDT)

> No protocol is resistant to dictionary attack under the above

  The point is that increasing the size of the PSK does not make the
_protocol_ resistant to dictionary attack. It just makes the attack
harder to successfully conclude.

  This is not my definition by the way. But instead of paraphrasing, let
me quote from "Authenticated Key Exchange Secure Against Dictionary
Attacks" by Bellare, Pointcheval, and Rogaway:

        "A theorem asserting security of some protocol make qualitative
         how much _computation_ helps and just how much _interaction_
         does. One sees whether or not one has security against dictionary
         attacks by looking to see if maximal adversarial advantage grows
         primarily with the ratio of interaction to the size of the password
         space."

Increasing the size of the PSK just makes the "password space" larger
but that has no effect on interaction. With the TLS PSK ciphersuites,
there's one interaction and then there's a whole bunch of computation.
Increasing the amount of computation necessary doesn't make the
protocol resistant to dictionary attack because there's still just one
interaction-- the adversarial advantage does not grow primarily with
the ratio of interaction to the size of the search space.

  And there are protocols that are resistant to dictionary attack under
that definition. There's one in the paper. Or look at your favorite PAKE.

  Dan.

---

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 22 Oct 2014 00:35:47 +0300

> that definition. There's one in the paper. Or look at your favorite PAKE.

There is a difference between collecting enough information to break
the protocol (which is quite little with _any_ practical protocol) and
collecting enough information to "easily" break the protocol.

Whole practical cryptography is based on the assumption that it doesn't
matter if attacker has enough information to break it, if the
computation is just too titanic.

However, if you have things like long-term passwords involved, that
are easily breakable (due to insufficient entropy) given some
information, one wants to make collecting that information hard.
This is what PAKEs are about.

However, proper PSKs have high entropy, so even with enough
information, it is very difficult to break one.

-Ilari