Re: New work for sacred working group?

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Stephen Farrell <stephen.farrell@xxxxxxxxx> writes:

>So I would guess that for sacred, TLS-PSK isn't an unencumbered equivalent
>since offline dictionary attacks are a high priority here. Or am I misreading
>something?

Oh, that's only if you use the weakest (most lightweight) form of PSK, with
the entire shared secret being the PSK.  In this form it's assumed that you'd
be using a high-entropy key rather than just a password.  The stronger (but
more heavyweight) forms use a standard RSA or DH exchange (alongside the PSK
data), so this isn't an issue.  Note that even the most heavyweight form, DHE
+ PSK, only has the same overhead as the SPEKE/SRP/etc-type protcols.

Peter.