A casual message exchange on reddit yesterday got me thinking whether it might be possible to design a protocol that removes the need for users to remember a unique password for every service (s)he connects to.
The idea is that essentially each user supplies identifying credentials (name, date of birth, city of birth) and a secret pass-phrase. Based on this information, and the service being accessed (optional, in case the user does not want to be tracked across services), the client software can deterministically generate a RSA keypair (using a secure hashing scheme, SHA-512 maybe).
The public component of this keypair is passed to the service, and serves both as an authentication token and an encryption key. User need only remember one pass-phrase, and credentials to access any service from any client, with the public key being her secure identification. Ephemeral session-specific keys can still be used be used for forward secrecy.
I'm wondering what the drawbacks to this scheme are? It is not susceptible to spoofing unless the imposter gets hold of the private key, lack of multiple passwords make it more secure and reliable for users. It is susceptible to MITM and a compromised client (because it sees the pass-phrase), but that is the same as SSL today, and the threat of key-loggers.
So, I'm just wondering if there are any serious drawbacks I have missed, and also if someone wanted to experiment with this, would it make sense to build this on top of TLS (an extension to http, maybe), or to replace it?
Thanks Thomas Pornin for the well-reasoned answer. I wonder if the following are valid rebuttals to the (well-founded objections) you raised:
1.Since there is only one password in this scheme, it is not unreasonable for there to be stringent complexity requirements (e.g. at least 128 bytes etc), so it is not susceptible to dictionary attacks. Dictionary attacks are really the same as saying if the attacker has infinite resources at his disposal, he can brute force any scheme. As long as the scheme is such that no information can be obtained by guessing portions of password, then it is surely possible to make dictionary attacks impractical?
- Regarding need for changing the password: this would not be possible within the limitied protocol described in the question. Maybe when registering the users' public identity, the server can send a secret encoded with users' key that should be used only to invalidate the identity when required? As long as there is a public key per service (i.e. generated deterministically based on an unentangleable combination of user password and service identity, then an attacker can only compromise the access on a particular service).
Btw, do you know of any well known algorithms to generate the key pair based only on a (for instance) 512 bit number? I suppose this is same as asking if there is a way to find the closest safe prime given a number. Thanks!