Subject: [ietf-tls] Proposal: SRP as a TLS authentication mechanism

From: "David Taylor" <[email-masked]>
Date: Wed, 31 Jan 2001 13:47:41 +1100

Hi all,

While doing some work with SASL and SRP recently, I realised I was trying
to recreate the TLS session/connection relationship using an SASL
mechanism.

After finishing the design I went back to our TLS implementation and added
a TLS_SRP_IDEA_CBC_SHA cipher suite as a proof of concept. This is almost
done and seems like it will work (the client and server are using the
40-byte shared secret generated by the SRP algorithm as the pre-master
secret). No new handshake messages were required, although extra data was
added to the client hello message, and the handshake now has client and
server messages interleaved while exchanging SRP parameters.

Does the idea of name/password client authentication built into TLS sound
useful or not?

Looking through the TLS mailing list archives, it seems there has been some
interest in secure passwords and TLS, but there also seemed to be a lot of
opposition to the idea. The main point seemed to be that application
protocols can use SASL (or something similar) to improve their security, so
there is no point adding these features to TLS.

If this SRP work is of interest, I will write a document describing the
changes to the handshake protocol and the messages. If the idea takes off,
I will also review the earlier documents produced when people were talking
about this a few years ago (if I can still find them via the links in the
e-mails) and see if they have a better mechanism than the handshake I'm
using at present.

Regards,
David Taylor
Forge Information Technology.

http://www.forge.com.au
http://www.protekt.com

Ph: +61 2 9209 4152
Fax: +61 2 9209 4172

-----------------------------------------------------------------------------------------------------------------------------------------

This message contains privileged and confidential information intended only
for the use of
the addressee named above. If you are not the intended recipient of this
message you
must not disseminate, copy or take any action in reliance on it. If you
have received
this message in error please notify the sender immediately. Any views
expressed in this
message are those of the individual sender, except where the sender
specifically states
them to be the views of another (including a Body Corporate).
-----------------------------------------------------------------------------------------------------------------------------------------

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Tom Wu <[email-masked]>
Date: Tue, 30 Jan 2001 22:59:16 -0800

> server messages interleaved while exchanging SRP parameters.

I'd be very interested in reviewing your proposal, since getting secure
password auth integrated with SSL is a nontrivial accomplishment.

> there is no point adding these features to TLS.

Since TLS already supports client authentication, and since Kerberos
ciphersuties have been defined, it seems that user
authentication/identification is within the scope of TLS.  Strong
password-based authentication should make it even more widely usable. 
One application where this would be applicable is the secure
Telnet-over-TLS distribution I'm working on; currently authentication is
done by using SRP to authenticate the TLS Finished messages, but
integrating it into the handshake may prove to be a cleaner solution.

> Forge Information Technology.

Tom
-- 
Tom Wu
Principal Software Engineer
Arcot Systems
(408) 969-6124
"The Borg?  Sounds Swedish..."

---