Subject: [IPsec] Password-Based Auth: Two criteria comments

From: <[email-masked]>
Date: Mon, 22 Mar 2010 14:18:11 -0400

Summarizing what I said in the meeting:

(1) The performance criteria should include performance with large complex secrets (e.g., pre-shared keys), not just the smaller passwords that people can reasonably be expected to remember.

This is because a password-based authentication mechanism may be usefully applied to shared secret authentication implementations that derive a supposedly strong secret solely from a password (see the discussion of pre-shared key authentication in Section 2.15 of RFC 4306).  Password-based authentication would provides some defense against this and other key generation weaknesses.  The original password that was used to generate the shared secret may no longer be available, so good performance on large complex secrets would enable password based authentication to use the derived (supposedly strong) secret as the password.

(2) Management (e.g., password change, password policy) is not mentioned in the criteria document.  This is good.

Keeping management orthogonal (i.e., out of scope of this criteria discussion) is (IMHO) a good thing, as management techniques and requirements may vary widely across classes of implementations.

Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 22 Mar 2010 20:28:22 +0200

Hi David,

I think both of these are (correct) requirements, rather than criteria. 
None of the algorithms I've seen care whether it's a 6-char ASCII 
password, or 512 truly-random bits. None of them say anything about 
management (with the possible exception of the "augmented" algorithms 
where the "augmentation" has some bearing on management).

Regarding management, -01 says this, which I think is in line with what 
you're saying:

It is noted that some features (such as support for password expiry)
    and some security criteria (such as resistance to server compromise)
    are very important for the "teleworker" use case.  This document is
    limited to the use of password-based authentication to achieve trust
    between gateways, and for this use case, these features and criteria
    are of questionable value.

Thanks,
	Yaron

On 22.3.2010 20:18, [email-masked] wrote:
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Mon, 22 Mar 2010 21:35:47 +0200

> This is because a password-based authentication mechanism may be usefully applied to shared secret authentication implementations that derive a supposedly strong secret solely from a password (see…

IKE already has PSK-based authentication. If my "password" is 9975612f178b31164bef5bb672cbeb1db6437d6459ff1d8a17f12ec73fcd5c92, then I don't need any new-fangled mode, because the authentication described in section 2.15 of RFC 4306 is good enough.

The new mode we're looking for is for giving a little security for people who use the password "yoav71", thinking that nobody would ever guess it.

---

From: <[email-masked]>
Date: Mon, 22 Mar 2010 17:20:04 -0400

Yoav,

> IKE already has PSK-based authentication. If my "password" is
> 9975612f178b31164bef5bb672cbeb1db6437d6459ff1d8a17f12ec73fcd5c92, then
I don't need any new-fangled
> mode, because the authentication described in section 2.15 of RFC 4306
is good enough.

If that "password" was generated from a known hash of a low entropy
password with no additional entropy input (this is discussed as a
possibility in Section 2.15 of 4306), that "password" is weak, and
changing the hash to double the length of the output won't strengthen
the result.

> The new mode we're looking for is for giving a little security for
people who use the password
> "yoav71", thinking that nobody would ever guess it.

And I'm suggesting the it may also be usefully applicable to
SHA-1("yoav71") with default padding.

I completely agree that "yoav71" is typical of the most important use
case.  I'm trying to point out that it may not be the only relevant use
case.

Thanks,
--David

> -----Original Message-----
> From: Yoav Nir [mailto:[email-masked]]
> Sent: Monday, March 22, 2010 3:36 PM
> To: Black, David
> Cc: [email-masked]
> Subject: Re: [IPsec] Password-Based Auth: Two criteria comments
> 
> 
> > (1) The performance criteria should include performance with large
complex secrets (e.g., pre-shared
> keys), not just the smaller passwords that people can reasonably be
expected to remember.
> >
> > This is because a password-based authentication mechanism may be
usefully applied to shared secret
> authentication implementations that derive a supposedly strong secret
solely from a password (see the
> discussion of pre-shared key authentication in Section 2.15 of RFC
4306).  Password-based
> authentication would provides some defense against this and other key
generation weaknesses.  The
> original password that was used to generate the shared secret may no
longer be available, so good
> performance on large complex secrets would enable password based
authentication to use the derived
> (supposedly strong) secret as the password.
> 
> IKE already has PSK-based authentication. If my "password" is
> 9975612f178b31164bef5bb672cbeb1db6437d6459ff1d8a17f12ec73fcd5c92, then
I don't need any new-fangled
> mode, because the authentication described in section 2.15 of RFC 4306
is good enough.
> 
> The new mode we're looking for is for giving a little security for
people who use the password
> "yoav71", thinking that nobody would ever guess it.