Subject: [radext] #142: Comments on Section 7.1

From: "radext issue tracker" <[email-masked]>
Date: Tue, 27 Nov 2012 05:26:23 -0000

#142: Comments on  Section 7.1

 7 Section 7.1

 Should note that TLS-PSK is not resistant to dictionary attacks.

 Its not clear to me why you are recommending hashing the output of the
 CSPRNG.  I think it would be better to recommend that PSKs be at least 16
 octets (or 32 if you prefer) generated from a strong random number
 generator.  Randomness recommendations are provided in BCP106(RFC4086)

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-radext-
  [email-masked]     |  [email-masked]
     Type:  defect       |     Status:  new
 Priority:  major        |  Milestone:  milestone1
Component:  dtls         |    Version:  1.0
 Severity:  In WG Last   |   Keywords:
  Call                   |
-------------------------+-------------------------------------------------

Ticket URL: <http://tools.ietf.org/wg/radext/trac/ticket/142>
radext <http://tools.ietf.org/radext/>

---

From: "radext issue tracker" <[email-masked]>
Date: Tue, 27 Nov 2012 13:03:41 -0000

Changes (by [email-masked]):

 * status:  new => closed
 * resolution:   => fixed

Comment:

 Suggested text:

 Where a TLS pre-shared key (PSK) method is used, implementations MUST
 support keys of at least 16 octets in length.  Implementations SHOULD
 support key lengths of 32 octets, and SHOULD allow for longer keys.
 The key data MUST be capable of being any value (0 through 255,
 inclusive).  Implementations MUST NOT limit themselves to using
 textual keys.  It is RECOMMENDED that the administration interface
 allos for the keys to be entered as hex strings.

 It is RECOMMENDED that keys be derived from a cryptographically secure
 pseudo-random number generator (CSPRNG).  If managing keys is too
 complicated, a certificate-based TLS method SHOULD be used instead.

 ...

 TLS-PSK methods are susceptible to dictionary attacks.  Section X.Y,
 above, recommends deriving TLS-PSK keys from a CSPRNG, which makes
 dictionary attacks significantly more difficult.  Servers SHOULD track
 failed client connections by TLS-PSK ID, and block TLS-PSK IDs which
 seem to be attempting brute-force searchs of the keyspace.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-radext-
  [email-masked]     |  [email-masked]
     Type:  defect       |      Status:  closed
 Priority:  major        |   Milestone:  milestone1
Component:  dtls         |     Version:  1.0
 Severity:  In WG Last   |  Resolution:  fixed
  Call                   |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://tools.ietf.org/wg/radext/trac/ticket/142#comment:1>
radext <http://tools.ietf.org/radext/>