Re: Suggestions For The Passing of Passphrases

From: Ari Silversteinn (abcarisilverstein_at_yahoo.comxyz)
Date: 06/08/05 

Date: Wed, 8 Jun 2005 17:49:36 -0400

On 8 Jun 2005 14:05:09 -0700, Alan wrote:

> First, I'm assuming the two parties have not prearranged a shared
> secret or protocol. If anything has been prearranged, the passphrase
> could have been communicated in that channel, and there would be many
> ways to proceed.

Correct.
 
> Therefore, the communication protocol must be negotiated in public, and
> an authenticating piece of information known to both must be agreed
> upon in public. For example, "We'll prove that both uf us know each
> other's mother's maiden name / birthday / etc." Hopefully you would
> use something better than that but you get the idea.

Correct, if they had a private non surveiled channel that was practical,
they would use it.

Although nemo may hook them up :)

> Once that is
> established, Secure Remote Password (SRP) could be used to derive a key
> for securing communications based on each participant's password.
> HOWEVER, an observer will know the type of information agreed upon as
> the password. If the observer knows the identity of the participants
> he might even know the value of the password.

This is correct so if the exchange between A and B is in front of God and
Company, then it would have to be a well kept secret *and* one easily
remembered, tip of the tongue.
 
> If an observer cannot determine (or gain significant information about)
> the password, I think the protocol is as secure as SRP. The trouble is
> finding a piece of data that both of you know but an observer cannot
> deduce from the negotiation phase.
>
> Alan

I visited this site for SRP and, frankly, it befuzzles me. A and B are
computer savvy but unless I misses something, this requires more than that
to generate SRP and for each of them to be able to handily use it.

Yes? 

-- 
Drop the alphabet for email

Relevant Pages

  • Re: Suggestions For The Passing of Passphrases
    ... secret or protocol. ... Therefore, the communication protocol must be negotiated in public, and ... an observer will know the type of information agreed upon as ... I think the protocol is as secure as SRP. ...
    (sci.crypt)
  • SRP (Secure Remote Passwords) weakness
    ... Here's a problem with the specification and implementation of SRP ... "Key exchange" means something like Diffie-Hellman, ... authenticate to a server, ... one protocol run to perform a brute-force search for the password, ...
    (sci.crypt)
  • Re: [OT] can anyone offer Lisp job?
    ... The VT100 protocol defines basic ... While you can connect via a modem, normally you need some other piece ... though there were some 'terminals' ... pretty much the same level of communication (with slightly easier ...
    (comp.lang.lisp)
  • Re: password salting
    ... When password is known it is not SRP, ... but a variant of D/H. ... Then you would just run the protocol as normal to get ... | your suggestion to generate random session key with "fixed password" ...
    (microsoft.public.dotnet.security)
  • Re: Quantum entanglement and information transfer
    ... These correlations ... > require no communication between the correlated ... information state of an observer at B (even if the only information is ... The fact that quantum entanglement is ...
    (sci.physics.research)
Loading