<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Augmented PAKE avoids the raw credentials problem. But PAKE doesn’t solve all problems. Without PKI it’s a duckling model at best, and you don’t log into every website every time with a password.</div><div class=""><br class=""></div><div class="">— Mike</div><br class=""><div><blockquote type="cite" class=""><div class="">On Jan 23, 2015, at 2:49 PM, Justin King-Lacroix <<a href="mailto:justin.king-lacroix@cs.ox.ac.uk" class="">justin.king-lacroix@cs.ox.ac.uk</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">I think "is" and "should be" have been conflated. (Unfortunately -- PKI needs to die, I agree.)<div class=""><br class=""></div><div class="">Is PAKE really the way to go, though? Having servers store raw (as opposed to salt-hashed) credentials feels like a mistake.</div><div class=""><br class=""></div><div class="">J</div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On 23 January 2015 at 09:57, U.Mutlu <span dir="ltr" class=""><<a href="mailto:for-gmane@mutluit.com" target="_blank" class="">for-gmane@mutluit.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">SSL certificate stuff (ie. PKI) is IMO dead. NSA killed it.<br class="">
Back to the roots: hashed pw over MITM-safe sessions (SRP, SPEKE etc, ie. PAKE).<br class="">
<br class="">
cu<br class="">
Uenal<br class="">
<br class="">
______________________________<u class=""></u>_________________<br class="">
Messaging mailing list<br class="">
<a href="mailto:Messaging@moderncrypto.org" target="_blank" class="">Messaging@moderncrypto.org</a><br class="">
<a href="https://moderncrypto.org/mailman/listinfo/messaging" target="_blank" class="">https://moderncrypto.org/<u class=""></u>mailman/listinfo/messaging</a><br class="">
</blockquote></div><br class=""></div>
_______________________________________________<br class="">Messaging mailing list<br class=""><a href="mailto:Messaging@moderncrypto.org" class="">Messaging@moderncrypto.org</a><br class="">https://moderncrypto.org/mailman/listinfo/messaging<br class=""></div></blockquote></div><br class=""></body></html>