- From: Peter Thatcher via GitHub <sysbot+gh@w3.org>
- Date: Mon, 16 Sep 2019 01:21:59 +0000
- To: public-webscreens@w3.org
pthatcherg has just created a new issue for https://github.com/webscreens/openscreenprotocol: == Must insert certificate fingerprints into SPAKE2 flow == With the challenge/response flow, we had protection against MITM attacks by including certificate fingerprints in the messages, but it looks like we lost that in the transition to SPAKE2, so we need to fix that. This is the issue dschinazi@ brought up at TPAC 2019 as a need for "entanglement" between the QUIC connection and the SPAKE2 handshake, and I believe he's right and we need to fix it. I think we could fix this by specifying that the identities A and B reference in draft-irtf-cfrg-spake2-08 are the client and server fingerprints. By the way, I think we also need to transmit S, T, X, and Y (various random numbers), similarly to how we did this when we defined JPAKE messages. Please view or discuss this issue at https://github.com/webscreens/openscreenprotocol/issues/226 using your GitHub account
Received on Monday, 16 September 2019 01:22:00 UTC