Subject: Re: [Lurk] Which authentication methods to consider ?

From: Daniel Migault <[email-masked]>
Date: Mon, 14 Mar 2016 11:49:19 +0000

Hi,

Can we consider that so far, there is a consensus on only considering rsa, ecdhe_rsa, ecdsa_ecdhe when designing the protocol.

BR,
Daniel

From: Watson Ladd [mailto:[email-masked]]
Sent: Friday, February 19, 2016 4:21 PM
To: Andrei Popov
Cc: LURK BoF; Daniel Migault
Subject: Re: [Lurk] Which authentication methods to consider ?

Given the usecase seems to be CDN authenticated using keys of content provider RSA, RSA - ECDHE, ECDSA - ECDHE, seem like enough to me.

On Feb 19, 2016 12:12 PM, "Andrei Popov" <[email-masked]<mailto:[email-masked]>> wrote:
>
> I think it’s a bit too early to exclude RSA at this point. Can’t comment on the usefulness of PSK for LURK purposes.
>
>
>
> Cheers,
>
>
>
> Andrei
>
>
>
> From: Lurk [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Daniel Migault
> Sent: Friday, February 19, 2016 11:45 AM
> To: LURK BoF <[email-masked]<mailto:[email-masked]>>
> Subject: [Lurk] Which authentication methods to consider ?
>
>
>
> Hi,
>
>
>
> Authentication methods that have been designed for TLS are:  rsa, dh_dss, dh_rsa, dh_dss, dh_rsa, ecdh_rsa, dh_anon, ecdh_anon, dhe_dss, dhe_rsa, ecdhe_ecdsa, ecdhe_rsa, psk, dhe_psk, rsa_psk
>
>
>
> One possibility is that we reduce the number of authentication methods to dhe/ecdhe.
>
>
>
> Anyone thinks we should extend / reduce authentication methods in scope of LURK?
>
>
>
> BR,
>
> Daniel
>
>
>
>
>
>
>
> DANIEL MIGAULT
> Researcher
> Research
>
>
> Ericsson
> 8500 Boulevard Decarie
> H4P 2N2 Montreal, Canada
> Phone +1 514 345 7900 46628
> Mobile +1 514 452 2160
> [email-masked]<mailto:[email-masked]>
> www.ericsson.com<http://www.ericsson.com>
>
>
>
>
>
> Legal entity: Ericsson Canada Inc., registered office in Montreal. This Communication is Confidential. We only send and receive email on the basis of the terms set out at www.ericsson.com/email_disclaimer<http://www.ericsson.com/email_disclaimer>
>
>
> _______________________________________________
> Lurk mailing list
> [email-masked]<mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/lurk
>

---

From: Василий Долматов <[email-masked]>
Date: Mon, 14 Mar 2016 16:04:08 +0300

Do not think so.

Protocols are ageing, becoming broken, have patent and other regulatory limitations, so we need to put common solution, which is protocol-independent and can be filled with given protocols without any change in general scheme.

> 14 марта 2016 г., в 14:49, Daniel Migault <[email-masked]> написал(а):
> 
> Hi,
> 
> From: Watson Ladd [mailto:[email-masked] <mailto:[email-masked]>]
> On Feb 19, 2016 12:12 PM, "Andrei Popov" <[email-masked] <mailto:[email-masked]>> wrote:
> >
> > From: Lurk [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Daniel Migault
> > To: LURK BoF <[email-masked] <mailto:[email-masked]>>
> > [email-masked] <mailto:[email-masked]>
> > www.ericsson.com <http://www.ericsson.com/>
> >
> >
> >
> >
> >
> > Legal entity: Ericsson Canada Inc., registered office in Montreal. This Communication is Confidential. We only send and receive email on the basis of the terms set out at www.ericsson.com/email_disclaimer <http://www.ericsson.com/email_disclaimer>
> >
> >
> > [email-masked] <mailto:[email-masked]>
> > https://www.ietf.org/mailman/listinfo/lurk <https://www.ietf.org/mailman/listinfo/lurk>
> >
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/lurk <https://www.ietf.org/mailman/listinfo/lurk>

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 14 Mar 2016 15:07:16 +0200

As far as I know, DHE_RSA is also widely used, but I don't have 
statistics to back this claim. RFC 7525's top recommendation is 
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256.

Thanks,
     Yaron

On 03/14/2016 01:49 PM, Daniel Migault wrote:
>
> Hi,
>
> Can we consider that so far, there is a consensus on only considering 
> rsa, ecdhe_rsa, ecdsa_ecdhe when designing the protocol.
>
> BR,
>
> Daniel
>
> *From:*Watson Ladd [mailto:[email-masked]]
> *Sent:* Friday, February 19, 2016 4:21 PM
> *To:* Andrei Popov
> *Cc:* LURK BoF; Daniel Migault
> *Subject:* Re: [Lurk] Which authentication methods to consider ?
>
> Given the usecase seems to be CDN authenticated using keys of content 
> provider RSA, RSA - ECDHE, ECDSA - ECDHE, seem like enough to me.
>
> On Feb 19, 2016 12:12 PM, "Andrei Popov" <[email-masked] 
> <mailto:[email-masked]>> wrote:
> >
> > I think it’s a bit too early to exclude RSA at this point. Can’t 
> comment on the usefulness of PSK for LURK purposes.
> >
> >
> >
> > Cheers,
> >
> >
> >
> > Andrei
> >
> >
> >
> > From: Lurk [mailto:[email-masked] 
> <mailto:[email-masked]>] On Behalf Of Daniel Migault
> > Authentication methods that have been designed for TLS are:  rsa, 
> dh_dss, dh_rsa, dh_dss, dh_rsa, ecdh_rsa, dh_anon, ecdh_anon, dhe_dss, 
> dhe_rsa, ecdhe_ecdsa, ecdhe_rsa, psk, dhe_psk, rsa_psk
> >
> >
> >
> > www.ericsson.com <http://www.ericsson.com>
> >
> >
> >
> >
> >
> > Legal entity: Ericsson Canada Inc., registered office in Montreal. 
> This Communication is Confidential. We only send and receive email on 
> the basis of the terms set out at www.ericsson.com/email_disclaimer 
> <http://www.ericsson.com/email_disclaimer>
> >
> >
> [email-masked]

---

From: Yoav Nir <[email-masked]>
Date: Mon, 14 Mar 2016 15:17:10 +0200

> On 14 Mar 2016, at 3:07 PM, Yaron Sheffer <[email-masked]> wrote:
> 
> As far as I know, DHE_RSA is also widely used, but I don't have statistics to back this claim.

I don’t have much statistics on DHE_RSA *use*, but we have some numbers on support:
https://securitypitfalls.wordpress.com/2015/12/07/november-2015-scan-results/
(anybody know why they stopped updating this monthly?)

So 54% of websites support DHE, which I assume is DHE_RSA rather than something more silly.  Also, 80% support ECDHE and the chart does not tell how many are “DHE and not ECDHE” or how many will choose DHE when the client proposes DHE_RSA, ECDHE_RSA, and straight RSA.  So it’s hard to know how much DHE_RSA is actually in use.

Yoav

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 14 Mar 2016 13:52:24 +0000

If CDN is the intial use-case, then perhaps ask some CDN’s what they see?  I can get Akamai’s list.  Are other CDN’s in this WG?

--
Senior Architect, Akamai Technologies
IM: [email-masked] Twitter: RichSalz

From: Yoav Nir [mailto:[email-masked]]
Sent: Monday, March 14, 2016 9:17 AM
To: Yaron Sheffer
Cc: Watson Ladd; Daniel Migault; Andrei Popov; LURK BoF
Subject: Re: [Lurk] Which authentication methods to consider ?

On 14 Mar 2016, at 3:07 PM, Yaron Sheffer <[email-masked]<mailto:[email-masked]>> wrote:

I don’t have much statistics on DHE_RSA *use*, but we have some numbers on support:
https://securitypitfalls.wordpress.com/2015/12/07/november-2015-scan-results/<https://urldefense.proofpoint.com/v2/url?u=https-3A__securitypitfalls.wordpress.com_2015_12_07_november-2D2015-2Dscan-2Dresults_&d=CwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=6CK3HIgkFY8LdSe3JxfXCxqIuUpOPjhlLqapVCtTo00&s=D-Gj-5S7EKvTJh_1CXq3mpzLATkI6SrOP0tUj-N_CpU&e=>
(anybody know why they stopped updating this monthly?)

Yoav

---

From: Daniel Migault <[email-masked]>
Date: Mon, 14 Mar 2016 14:00:59 +0000

Hi,

When I am wondering which authentication method to consider, I would like to end up with a small set of strong authentication methods that are actually used, and would make sense to implement.

Here are some ways we can reduce the set of authentications methods:

1)      Remove any weak authentication methods – however popular they are.

2)      Remove authentication methods that have not been widely deployed. I suspect PSK is one of these.

3)      Consider authentication methods that are used by CDNs

4)      Consider authentication methods that are used by application candidates to the CDN.

5)      Consider methods that might be advantageous with LURK. be Does anyone think dh_anon for example could fall into this category.?

Of course authentication methods can still be added after, but we would like a core system that can be implemented in a timely manner.

From: Yoav Nir [mailto:[email-masked]]
Sent: Monday, March 14, 2016 10:17 AM
To: Yaron Sheffer
Cc: Daniel Migault; Watson Ladd; Andrei Popov; LURK BoF
Subject: Re: [Lurk] Which authentication methods to consider ?

Yoav

---

From: Daniel Migault <[email-masked]>
Date: Mon, 14 Mar 2016 14:02:23 +0000

Exactly, inputs from CDNs and telco CDNs would be very useful. Please let us know the authentication method that are are of interest for you.
BR,
Daniel

From: Salz, Rich [mailto:[email-masked]]
Sent: Monday, March 14, 2016 10:52 AM
To: Yoav Nir; Yaron Sheffer
Cc: Watson Ladd; Daniel Migault; Andrei Popov; LURK BoF
Subject: RE: [Lurk] Which authentication methods to consider ?

--
Senior Architect, Akamai Technologies
IM: [email-masked]<mailto:[email-masked]> Twitter: RichSalz

Yoav

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 14 Mar 2016 21:03:23 +0000

> Exactly, inputs from CDNs and telco CDNs would be very useful. Please let us know the authentication method that are are of interest for you.

From my employer's perspective, these are the two most important ones:
	RSA signatures as used in TLS
	ECDSA signatures as used in TLS
The next two are these, and in no particular order at this time:
	Ed448 (or whatever it ends up being called) as used in TLS
	AESGCM256 encryption and decryption of tickets
ECDHE, X25519, etc -- the PFS key exchange -- are not important to us.

Akamai probably has more, and older, legacy clients than other CDN's, but I'd be really curious to see what others say.

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 14 Mar 2016 21:09:03 +0000

Just to make clear, the linebreak was lost.

> -----Original Message-----
> Sent: Monday, March 14, 2016 5:03 PM
> To: Daniel Migault; Yoav Nir; Yaron Sheffer
> Cc: Watson Ladd; Andrei Popov; LURK BoF
> > Exactly, inputs from CDNs and telco CDNs would be very useful. Please let
> us know the authentication method that are are of interest for you.
>

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 14 Mar 2016 23:12:09 +0200

Exactly, inputs from CDNs and telco CDNs would be very useful. Please 
let us know the authentication method that are are of interest for you.
> Akamai probably has more, and older, legacy clients than other CDN's, but I'd be really curious to see what others say.
Are there people using ECDSA certs with no PFS? I am surprised. Maybe 
large organizations who manage their own CAs?

Thanks,
     Yaron

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 14 Mar 2016 21:18:19 +0000

> Are there people using ECDSA certs with no PFS? I am surprised. Maybe large
> organizations who manage their own CAs?

I am sorry, I think the lack of linebreak was confusing.

We are interested in the long-term TLS key used for server auth.   We might be interested  in TLS ticket/session data.  We are not interested in the ephemeral keys for PFS.  Is that more clear?

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 14 Mar 2016 23:38:05 +0200

> We are interested in the long-term TLS key used for server auth.   We might be interested  in TLS ticket/session data.  We are not interested in the ephemeral keys for PFS.  Is that more clear?
ׂGot it, thanks for the clarification. I think Daniel's original question 
was about specific authentication methods because the key material that 
needs to be derived by the LURK "box" will vary for different auth methods.

Thanks,
     Yaron

---

From: Martin Thomson <[email-masked]>
Date: Tue, 15 Mar 2016 11:26:06 +1100

> (anybody know why they stopped updating this monthly?)

This might help: http://mzl.la/1pHJ82k (columns 21 through 25)

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 15 Mar 2016 09:44:39 +0200

> This might help: http://mzl.la/1pHJ82k (columns 21 through 25)
And the secret key is line 1064 of 
https://dxr.mozilla.org/mozilla-central/source/security/manager/ssl/nsNSSCallbacks.cpp#

Very informative. Thanks!