[27249] in cryptography@c2.net mail archive
Re: Status of SRP
daemon@ATHENA.MIT.EDU (Jeffrey Altman)
Sun Jun 4 13:26:48 2006
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
Date: Sun, 04 Jun 2006 11:55:42 -0400
From: Jeffrey Altman <jaltman@columbia.edu>
To: "James A. Donald" <jamesd@echeque.com>
Cc: cryptography@metzdowd.com
In-Reply-To: <44810F53.3040402@echeque.com>
This is a cryptographically signed message in MIME format.
--------------ms040509080800090402070207
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
James A. Donald wrote:
> --
> Jeffrey Altman wrote:
>> Unfortunately, SRP is not the solution to the phishing
>> problem. The phishing problem is made up of many
>> subtle sub-problems involving the ease of spoofing a
>> web site and the challenges involved in securing the
>> enrollment and password change mechanisms.
>
> With SRP, the web site cannot be spoofed, for it must
> prove it knows the user's secret passphrase.
James, SRP can only prevent spoof's of successful authentications
and it can only prevent spoof's when it is actually used.
It cannot prevent spoof's of unsuccessful authentications and that
is where a huge part of the problem lies. Consider the reaction
of many individuals when they receive a page that indicates that
their username and/or password are incorrect?
Sites that offer the common secret question(s) can be spoofed.
The attacker spoof's sits in the middle, captures the question from
the real site, the answer from the user, and if the real site says
that the new password is being sent, puts up a new page indicating
that the password should be changed online along with prompts for
private information that the attacker wants.
Stopping phishing with successful authentication is not even half
the problem.
Jeffrey Altman
--------------ms040509080800090402070207
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJWTCC
AwcwggJwoAMCAQICEDgwMdSemBfcGd6HY5Q4qrwwDQYJKoZIhvcNAQEEBQAwYjELMAkGA1UE
BhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMT
I1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA2MDUyNzIyMDMzMloX
DTA3MDUyNzIyMDMzMlowazEPMA0GA1UEBBMGQWx0bWFuMRUwEwYDVQQqEwxKZWZmcmV5IEVy
aWMxHDAaBgNVBAMTE0plZmZyZXkgRXJpYyBBbHRtYW4xIzAhBgkqhkiG9w0BCQEWFGphbHRt
YW5AY29sdW1iaWEuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmFluisw/
NLjjXSHm0kgAgAMBknaWpJyDQlTpyzSswiSaDWINyEUzM/teBosk003zfyQdPONkWzclBRZ+
oGsYsAgxmyRe9tAJD7Jo6xp/6kCuF5nnaIyz91gWyuYZEeqQrfyFnWIfQu3fuoSeEIMLc9ac
L9qhqnaTwCufH4v56CMftv6KFdf/k1CoLu/DL0ps5UOVwui+8iSWn3Qt6QfefDp9vbtBFPTV
nZ7wGeewUJrO1LEC+x3gAOW+KxUcZMBax7tVygT5hDaQXm5lxUrlMQ/hLeWpv7LkVPD/ytoJ
NCNzSnycrK4juG1CI12m5K1TNHZJ1uYjb7DUvMwOl6kQiQIDAQABozEwLzAfBgNVHREEGDAW
gRRqYWx0bWFuQGNvbHVtYmlhLmVkdTAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBBAUAA4GB
ACNK1Xef6H2YL02xqVthcdQgFuF0bENE1u7gX/hegF1awGERhaIJmKGWau4OiAeHnlFqWysP
EFzVrSb6L+TF9YHd/bP8WtxccOFnZ1L6oe7KOiyNfXGPZKj/i7Gti+MF4RM1ReZncTC1zMmZ
DbFkVhL92vSgDGl4+6IwzjmQVK3sMIIDBzCCAnCgAwIBAgIQODAx1J6YF9wZ3odjlDiqvDAN
BgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRp
bmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3Vp
bmcgQ0EwHhcNMDYwNTI3MjIwMzMyWhcNMDcwNTI3MjIwMzMyWjBrMQ8wDQYDVQQEEwZBbHRt
YW4xFTATBgNVBCoTDEplZmZyZXkgRXJpYzEcMBoGA1UEAxMTSmVmZnJleSBFcmljIEFsdG1h
bjEjMCEGCSqGSIb3DQEJARYUamFsdG1hbkBjb2x1bWJpYS5lZHUwggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQCYWW6KzD80uONdIebSSACAAwGSdpaknINCVOnLNKzCJJoNYg3I
RTMz+14GiyTTTfN/JB0842RbNyUFFn6gaxiwCDGbJF720AkPsmjrGn/qQK4XmedojLP3WBbK
5hkR6pCt/IWdYh9C7d+6hJ4Qgwtz1pwv2qGqdpPAK58fi/noIx+2/ooV1/+TUKgu78MvSmzl
Q5XC6L7yJJafdC3pB958On29u0EU9NWdnvAZ57BQms7UsQL7HeAA5b4rFRxkwFrHu1XKBPmE
NpBebmXFSuUxD+Et5am/suRU8P/K2gk0I3NKfJysriO4bUIjXabkrVM0dknW5iNvsNS8zA6X
qRCJAgMBAAGjMTAvMB8GA1UdEQQYMBaBFGphbHRtYW5AY29sdW1iaWEuZWR1MAwGA1UdEwEB
/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEAI0rVd5/ofZgvTbGpW2Fx1CAW4XRsQ0TW7uBf+F6A
XVrAYRGFogmYoZZq7g6IB4eeUWpbKw8QXNWtJvov5MX1gd39s/xa3Fxw4WdnUvqh7so6LI19
cY9kqP+Lsa2L4wXhEzVF5mdxMLXMyZkNsWRWEv3a9KAMaXj7ojDOOZBUrewwggM/MIICqKAD
AgECAgENMA0GCSqGSIb3DQEBBQUAMIHRMQswCQYDVQQGEwJaQTEVMBMGA1UECBMMV2VzdGVy
biBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAYBgNVBAoTEVRoYXd0ZSBDb25zdWx0aW5n
MSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMSQwIgYDVQQDExtU
aGF3dGUgUGVyc29uYWwgRnJlZW1haWwgQ0ExKzApBgkqhkiG9w0BCQEWHHBlcnNvbmFsLWZy
ZWVtYWlsQHRoYXd0ZS5jb20wHhcNMDMwNzE3MDAwMDAwWhcNMTMwNzE2MjM1OTU5WjBiMQsw
CQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoG
A1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwgZ8wDQYJKoZIhvcN
AQEBBQADgY0AMIGJAoGBAMSmPFVzVftOucqZWh5owHUEcJ3f6f+jHuy9zfVb8hp2vX8MOmHy
v1HOAdTlUAow1wJjWiyJFXCO3cnwK4Vaqj9xVsuvPAsH5/EfkTYkKhPPK9Xzgnc9A74r/rsY
Pge/QIACZNenprufZdHFKlSFD0gEf6e20TxhBEAeZBlyYLf7AgMBAAGjgZQwgZEwEgYDVR0T
AQH/BAgwBgEB/wIBADBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLnRoYXd0ZS5jb20v
VGhhd3RlUGVyc29uYWxGcmVlbWFpbENBLmNybDALBgNVHQ8EBAMCAQYwKQYDVR0RBCIwIKQe
MBwxGjAYBgNVBAMTEVByaXZhdGVMYWJlbDItMTM4MA0GCSqGSIb3DQEBBQUAA4GBAEiM0VCD
6gsuzA2jZqxnD3+vrL7CF6FDlpSdf0whuPg2H6otnzYvwPQcUCCTcDz9reFhYsPZOhl+hLGZ
GwDFGguCdJ4lUJRix9sncVcljd2pnDmOjCBPZV+V2vf3h9bGCE6u9uo05RAaWzVNd+NWIXiC
3CEZNd4ksdMdRv9dX2VPMYIDZDCCA2ACAQEwdjBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMc
VGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFs
IEZyZWVtYWlsIElzc3VpbmcgQ0ECEDgwMdSemBfcGd6HY5Q4qrwwCQYFKw4DAhoFAKCCAcMw
GAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDYwNjA0MTU1NTQy
WjAjBgkqhkiG9w0BCQQxFgQUd0yNWQW/N10cwQPhK2ytdH1mpCYwUgYJKoZIhvcNAQkPMUUw
QzAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcw
DQYIKoZIhvcNAwICASgwgYUGCSsGAQQBgjcQBDF4MHYwYjELMAkGA1UEBhMCWkExJTAjBgNV
BAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJz
b25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAhA4MDHUnpgX3Bneh2OUOKq8MIGHBgsqhkiG9w0B
CRACCzF4oHYwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQ
dHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENB
AhA4MDHUnpgX3Bneh2OUOKq8MA0GCSqGSIb3DQEBAQUABIIBABxuslBEEBTtKPQFDkyBVxh2
5XATvbFntGSOg/tufjny3RLc1DZlRF/2SQUypkU0zmcIoZxcvcW8kmaxdZjMdij4GsNFrM2q
uUbsP1n0B3ZrDeXnzZcRNzYX5pXHOsGQobSM4GDoM5G0c/34ydSNKXPltU4dvgpmrnxyoYUR
Ebk1T8GQjZhvYfywZe1oVl0NjVWBED6UKrCRy6CIgjjiZUstQrfGWEl/Opc+LdLvB662QsZH
6jczUmDAlzH30UiQYkinpytuTnu/HnaqM+/rHKslWc0TspT5xKJyQycBh41xnTqbBpgHi7eK
8wqjlM0EEUGeQ8kIQ4PbNgdcm63gKsAAAAAAAAA=
--------------ms040509080800090402070207--
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
