[Cfrg] Proposed PAKE Selection Process

[Nick Sullivan <[e-mail]>]

Dear CFRG,

We’re planning to start the main phase of PAKE selection process. This
proposal was developed by Stanislav Smyshlyaev with the support of the CFRG
chairs.

In addition to helping drive this PAKE selection process, Stanislav has
been selected to the role of Secretary of the CFRG, a position that was
previously vacant.

To be 100% sure that the process will be as transparent and effective as
possible, we would like to announce the proposed plan of handling the
process. If you have any concerns about the plan, please send them to the
chairs before 27.05.2019.




Step 1, 01.06.2019-30.06.2019:

·        Call for candidate protocols. Note: the chairs especially
encourage to nominate PAKEs that have been discussed in CFRG recently (the
list can be found in the slides from IETF 104 CFRG session
<https://www.ietf.org/proceedings/104/slides/slides-104-cfrg-pake-selection-01.pdf>,
slide 9). Third Party nominations are encouraged.

·        Discussing the list of questions to be asked in addition to the
ones that are present in RFC 8125. Starting point for such list of
questions can be the questions gathered before IETF 104 (can be found in the
slides from IETF 104 CFRG session
<https://www.ietf.org/proceedings/104/slides/slides-104-cfrg-pake-selection-01.pdf>,
slides 7-8).

Step 2, 01.07.2019-19.07.2019:

·        The designers of the protocols (or persons who volunteered to push
them forward) prepare papers with:

a.      expanded answers for all positions of RFC 8125;

b.      their own opinions on additional questions selected at Step 1 (they
could be incomplete in some sense – for example, a designer of a PAKE might
not be an expert in TLS and might not be able to reply how his PAKE can be
incorporated in TLS 1.3).

IETF 105 meeting:

·        The chairs give a review of the progress with the process and make
corrections of plans.

·        The chairs enumerate questions (from the list that has been
prepared during Step 1) which should be considered by independent reviewers
before asking the Crypto Review Panel for reviews and analysis. For
instance, it will be important that experts from other WGs consider how
certain PAKEs fits into TLS 1.3, or into IoT devices.

Further steps (subject to corrections after IETF 105 meeting).

Step 3, 01.08.2019-15.08.2019:

·        Call for reviewers for the enumerated questions, which require
additional consideration.

·        Crypto Review Panel members start the process of verification of
security proofs of the candidates (Requirement 2 in RFC 8125).

Step 4, 16.08.2019-15.09.2019:

·        The reviewers who volunteered at step 3 prepare their analysis
regarding the assigned questions.

·        Crypto Review Panel members are in the process of verification of
security proofs of the candidates (Requirement 2 in RFC 8125).

Step 5, 16.09.2019-30.10.2019:

·        Crypto Review Panel members review all gathered materials on each
of the protocols to prepare the final list of verified answers to the
positions of RFC 8125 and all additional questions from the list that has
been prepared during Step 1.

·        If additional explanations are needed, Crypto Review Panel members
ask for them from the designers.

·        Crypto Review Panel members write overall reviews for all
candidate PAKEs, based on the materials that have been gathered and
verified.

Step 6, 01.11.2019-16.11.2019:

·        CFRG chairs discuss the obtained reviews and make their
recommendations to CFRG (or convey to CFRG that they can’t make a
recommendation yet).

 IETF 106 meeting:

·        The chairs give a review of the progress with the process and make
corrections of plans.

·        If everything is clear:

o   one (or more) PAKEs are selected;

o   the process with CFRG document “Recommendations for password-based
authenticated key establishment in IETF protocols” is initiated: all
practically important recommendations (parameter selection, protecting
implementations against side-channel attacks, handling of counters etc.)
must be given there;

o   at this point documents on usage of selected PAKEs in TLS/IPsec/etc.
can be developed.


Best regards,
Nick on behalf of Stanislav, Kenny, and Alexey