Re: Another entry in the internet security hall of shame....

[Damien Miller]

On Tue, 30 Aug 2005, Peter Gutmann wrote:


- A non-spoofable means of password entry that only applies for TLS-PSK
 passwords.  In other words, something where a fake site can't trick the user
 into revealing a TLS-PSK key.


This sounds like a solution replete with all the problems that passwords 
have had all along: users choosing bad ones, using the same ones for 
different sites, never changing them, servers getting hacked (disclosing 
the probably-shared passwords of thousands of users), etc. ad nauseum...


The last threat is particularly pertainent because it appears there is a 
requirement for servers to retain the PSK in cleartext. (To be fair, the 
draft does RECOMMENDED that implementations provide a way to generate 
random PSKs, but this has been recommeded for passwords in general for 
decades, to little effect.)


Given the complete lack of good password management practice in the vast 
majority of websites, what will make them start doing things right with 
TLS-PSK?


Maybe some of this could be solved with a good UI in the web browser (e.g. 
by treating the PSK as a key rather than a password), but arm-waving about 
UI refinements applies to improving certificate handling too.


-d

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]

Re: Fwd: Tor security advisory: DH handshake flaw

[Werner Koch]

On Thu, 01 Sep 2005 15:04:43 +0200, Simon Josefsson said:

 If you control the random number generator, you control which
 Miller-Rabin bases that are used too.

Oh well, if you are able to do this you have far easier ways of
compromising the security.  Tricking the RNG to issue the same number
to requests for the secret exponent of an DSA sign operation seems to
be easier.

 Designing this fake random number generator is not trivial, and must
 likely be done separately for each crypto library that is used.  If
 software only used prime numbers that came with a prime certificate,
 you combat this attack.

Here it would be easier to add a backdoor to the prime certificate
check than to implement a fake RNG.


Shalom-Salam,

   Werner


-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]