Subject: [perpass] PRISM-HARDENING Increasing the work factor

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 17 Sep 2013 14:44:07 -0400

My phrase PRISM-Proofing seems to have created some interest in the press.

PRISM-Hardening might be more important, especially in the short term. The
objective of PRISM-hardening is not to prevent an attack absolutely, it is
to increase the work factor for the attacker attempting ubiquitous
surveillance.

Examples include:

Forward Secrecy: Increases work factor from one public key per host to one
public key per TLS session.

Smart Cookies: Using cookies as authentication secrets and passing them as
plaintext bearer tokens is stupid. It means that all an attacker needs to
do is to compromise TLS once and they have the authentication secret. The
HTTP Session-ID draft I proposed a while back reduces the window of
compromise to the first attack.

I am sure there are other ways to increase the work factor.

-- 
Website: http://hallambaker.com/