Re: [Emu] comment on draft-ietf-emu-eap-gpsk

["Joseph Salowey (jsalowey)" <jsalowey at cisco.com>]

Thanks Dan,  I agree with your assessment.  I think we should include
text similar to what you propose in the document. 

Joe 

> -----Original Message-----
> From: emu-bounces at ietf.org [mailto:emu-bounces at ietf.org] On 
> Behalf Of Dan Harkins
> Sent: Tuesday, April 01, 2008 3:26 PM
> To: emu at ietf.org
> Subject: [Emu] comment on draft-ietf-emu-eap-gpsk
> 
> 
>   Hello,
> 
>   Section 11.6 of draft-ietf-emu-eap-gpsk says:
> 
>       EAP-GPSK relies on a long-term shared secret (PSK) that MUST be
>       based on at least 16 octets of entropy to guarantee security
>       against dictionary attacks.
> 
> This is not a generally accepted view of resistance to 
> dictionary attack. For instance, the excellent paper by 
> Bellare, Pointcheval, and Rogaway, Authenticated Key Exchange 
> Secure Against Dictionary Attacks says:
> 
>       One sees whether or not one has security against dictionary
>       attacks by looking to see if maximal adversarial advantage grows
>       primarily with the ratio of interaction to the size of the
>       password space.
> 
>   Open Key Exchange-- How to Defeat Dictionary Attacks 
> Without Encrypting Public Keys, by Stefan Lucks, says that 
> the probability of success of the attacker is based on the 
> size of the dictionary and the number of number of times the 
> attacker has been rejected (after active attack), and "does 
> not significantly exceed 1/(S-R)" where S is the size of the 
> dictionary and R is the number or rejections.
> 
>   Even RFC3748 says that for an EAP method to be resistant to 
> dictionary attacks that:
> 
>       ...the method does not allow an offline attack that has a work
>       factor based on the number of passwords in an 
> attacker's dictionary.
> 
>   The idea here is that merely making the size of the pool 
> from which the secret is drawn (i.e. "the dictionary") large 
> does not make a protocol resistant to dictionary attack. What 
> makes it resistant to dictionary attacks is whether an 
> attacker gets one guess at the password per active
> attack-- interaction-- and not an unlimited number after a 
> single attack-- computation.
> 
>   This draft implies that since the secret has "16 octets of 
> entropy"--
> 2^128 bits, which is quite a requirement!-- that it is 
> resistant to a dictionary attack. This is not correct.
> 
>   I really think this draft should be corrected to not imply 
> it has resistance to dictionary attack. I suggest something 
> along the lines of:
> 
>       The success of a dictionary attack against EAP-GPSK depends on
>       the strength of the long-term shared secret (PSK) it uses. The
>       PSK used by EAP-GPSK MUST be drawn from a pool of secrets that
>       is at least 2^128 bits large and whose distribution is uniformly
>       random. Note that this does not imply resistance to dictionary
>       attack, only that the probability of success in such an attack
>       is acceptably remote.
> 
>   regards,
> 
>   Dan.
> 
> 
> 
> 
> _______________________________________________
> Emu mailing list
> Emu at ietf.org
> https://www.ietf.org/mailman/listinfo/emu
> 
_______________________________________________
Emu mailing list
Emu at ietf.org
https://www.ietf.org/mailman/listinfo/emu