Subject: RE: New Intro Text was Re: LAST CALL - Public Key Cryptography for Initial Authentication in Kerberos

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 8 Nov 2005 11:03:17 -0800

>> Jeff wrote:
>> initial authentication increases the
>>    effort necessary to execute an offline attack on the client's long
>>    term secret.  

Chaskiel M Grundman wrote:
> Which claim is controversial? if you are referring to the "dynamic 
> process...",

I referred to the claim "...increases the effort necessary to execute an
offline attack on the client's long term secret". I do not claim right
away this is incorrect, it is just not clear to me.

I do understand that here at Redmond, we refer to the client's
public-private key pairs as "long term secrets" as well. 

I think it is misleading to say if you use PKINIT, you increase the
attacker's effort, you might not. 

This is because it all depends on the size of the key, for example a 256
bit AES key is not easier to crack than a 1024 bit RSA key pair, and I
just do not find the text helpful. 

If we want to convince someone to implement/adopt PKINIT with this text,
it is not sufficient then. Hypothetically if this protocol makes the
attacker's life just twice as harder, I would not be convinced.

Does this make sense?

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Chaskiel M
Grundman
Sent: Tuesday, November 08, 2005 10:39 AM
To: [email-masked]
Subject: RE: New Intro Text was Re: LAST CALL - Public Key Cryptography
for Initial Authentication in Kerberos

Note that I mostly agree with larry on the merits of the rewrite. In 
particular, combining "single sign on" and delegation doesn't make sense
to 
me. delegation is credential pass through, not single sign on. (There is

nothing about pk that prevents it from being used as an SSO mechanism.)

--On Tuesday, November 08, 2005 10:02:56 -0800 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:
>Jeffrey Altman wrote:
>>One
>> disadvantage of using symmetric-key cryptography is that the keys
>> must be shared, so that before a client can authenticate itself, he
>> must already be registered with the KDC.
> avoiding some form of the pre-registration is a significant
> advantage of using PKI.
>>    The use of public key certificates instead of password based long
>>    term keys when performing the initial authentication increases the
>>    effort necessary to execute an offline attack on the client's long
>>    term secret.  Depending on the implementation it may also be
> possible
>>    to construct a dynamic process by which clients are registered
with
>>    the KDC.
> [lzhu] this claim is controversial too. In addition, it is either too
> generic or vague that I did not find it helpful when I read it.

Which claim is controversial? if you are referring to the "dynamic 
process...", isn't that the same thing that avoids "some form of 
pre-registration" that you earlier indicated is a good idea?
(I don't think it is controversial to claim that a randomly-generated 
public key is harder to attack than a key derived from a password
provided 
by the user.)

---

From: Brian Tung <[email-masked]>
Date: Tue, 8 Nov 2005 11:33:23 -0800

> just do not find the text helpful. 

It is easier if the 256-bit AES key is password-derived.  That is a
common case with vanilla Kerberos.

> attacker's life just twice as harder, I would not be convinced.

If the difference is between password-derived key and randomly-generated
public key pair, the difference is much more than a factor of two.

-- 
Brian Tung <[email-masked]>
* etiam non me contradixisti * et cuniculi et vulpeculae moriuntur *
USC Information Sciences Institute