Subject: Re: [IPsec] [Cfrg] Beginning discussion on secure password-only authentication for IKEv2

From: "Blumenthal, Uri - 0662 - MITLL" <[email-masked]>
Date: Wed, 3 Mar 2010 09:25:47 -0500

You're good!  :-)

On the vendor side - perhaps EKE patent concern was the cause (you implement/sell free SRP and get slapped with EKE licensing)? And the users found alternative solutions in the meanwhile?

Do you think weak passwords are too dangerous overall (many other ways of attacking them outside of direct protocol attempts that we try to defend against), and so we shouldn't entertain them at all?

Tnx!
Regards,
Uri

----- Original Message -----
From: pgut001 <[email-masked]>
To: [email-masked] <[email-masked]>; Blumenthal, Uri - 0662 - MITLL
Cc: [email-masked] <[email-masked]>; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>; [email-masked] <[email-masked]>
Sent: Tue Mar 02 19:41:43 2010
Subject: Re: [Cfrg] [IPsec] Beginning discussion on secure password-only authentication for IKEv2

"Steven M. Bellovin" <[email-masked]> writes:

>Note that the EKE patent expires in October 2011.  (At least I think it does;
>it was filed in October 1991.)  Depending on when you expect implementations
>to appear-- and given how long it takes to produce standards-track documents
>in the IETF -- it might not be a problem.

Given that SRP implementations have been available and more or less freely 
usable for quite some time and TLS-PSK is completely unencumbered anyway, I 
think the real issue won't be "when will implementations appear" but "why 
isn't anyone using them when they are available"?

(Mind you that's a layer 8 issue, and therefore not our problem :-).

Peter.

---

From: thomwu <[email-masked]>
Date: Wed, 03 Mar 2010 07:47:41 -0800

On 3/3/10 6:25 AM, "Blumenthal, Uri - 0662 - MITLL" <[email-masked]> wrote:

> You're good!  :-)
> 
> On the vendor side - perhaps EKE patent concern was the cause (you
> implement/sell free SRP and get slapped with EKE licensing)? And the users
> found alternative solutions in the meanwhile?

No, I can say that this was definitely not the case in any instances that I
was involved in.  Performance, implementation complexity (of strong password
protocols in general), and protocol complexity ranked much higher on the
list.  Users cared far more about whether strong password protocols degraded
their user experience by adding round trips to the protocol; at that point,
patents were a complete non-issue.

Tom

---

From: <[email-masked]>
Date: Wed, 3 Mar 2010 15:34:14 -0500

This IPR disclosure is relevant to this discussion:
https://datatracker.ietf.org/ipr/63/

Thanks,
--David

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
Of Blumenthal, Uri - 0662 -
> MITLL
> Sent: Wednesday, March 03, 2010 9:26 AM
> To: [email-masked]'
> Cc: [email-masked]'; [email-masked]'
> Subject: Re: [IPsec] [Cfrg] Beginning discussion on secure
password-only authentication for IKEv2
> On the vendor side - perhaps EKE patent concern was the cause (you
implement/sell free SRP and get
> slapped with EKE licensing)? And the users found alternative solutions
in the meanwhile?
> 
> Do you think weak passwords are too dangerous overall (many other ways
of attacking them outside of
> direct protocol attempts that we try to defend against), and so we
shouldn't entertain them at all?
> Cc: [email-masked] <[email-masked]>; [email-masked]
<[email-masked]>;
> [email-masked] <[email-masked]>; [email-masked]
<[email-masked]>
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec