RE: [TLS] Review of draft-santesson-tls-gssapi-00

[<Pasi.Eronen at nokia.com>]

Stefan Santesson wrote:

> > As for taking security out of the picture, that was your claim not
> > mine. For me, this state machine issue *is* a security issue and
> > it's not purely an issue of establishing a key with a sufficiently
> > strong algorithm.
> 
> What other security issue than the strength of the key is there?
> TLS does not require any user authentication, so any added 
> technology here can only be positive if the alternative in anonymous.
> 
> Regarding key strength, I think all cryptographic experts 
> would agree that:
> 
> Good key XOR bad key = good key
> 
> At least if they are produced independent of each other, e.g.  that
> the bad key is not actively selected with knowledge of the good key
> to cancel it or make it bad.  Following this logic, you can safely
> have another process creating a key of un-known strength and XOR it
> with the "good" key of TLS, and preserve the security level of TLS.
> 
> This simple assumption, makes the security impact very easy 
> to analyze with respect to cryptographic strength.

I'm not sure what Eric had in mind here, but I don't think key
strength is the issue here. As we found out with e.g. PEAP and IKEv2,
adding a new layer or round of authentication can *reduce* security 
if the layers/rounds are not coupled together in the right way.
This *is* a big deal!

(I'm referring to the "Man-in-the-Middle in Tunneled Authentication"
paper by Asokan, Niemi and Nyberg; and related work.)

I think Eric's concern was that the proposal would be easier to
analyze if the interaction between current TLS state machine and
GSS-API would be done in some other way that in the current draft.

<snip>
> If it would not turn out to be a big deal, we have a significant win
> here by allowing numerous non-PKI based authentication technologies
> to be used with TLS. That is a "big deal".

No disagreement from me here...

Best regards,
Pasi

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls