Re: [Cfrg] PAKEs in general (was; Re: draft-irtf-cfrg-dragonfly document status)

[Andy Lutomirski <[e-mail]>]

On Thu, Oct 9, 2014 at 9:55 AM, Paul Lambert <[e-mail]> wrote:
>
> The Œmostly' is that the Dragonfly draft should be published
> so it can be used a little better in a couple of specific
> environments where it is already being wired into systems.
> Specifically, IEEE 802.11 has the SAE protocol which uses
> the Dragonfly exchange for mesh networks.  There are other
> peer-to-peer wireless applications that could use Dragonfly
> soon. In particular, the Wi-Fi industry also has a long
> standing issue with password based authentication
> being subject to brute-force attacks in the
> WPA2=Personal authentication (aka 4-way handshake).
> Dragonfly in the form of SAE will potentially
> be dropped in as a replacement for the current
> hash based exchange.

I believe that this is exactly why quite a few people (myself
included) think that CFRG should think long and hard before publishing
Dragonfly.  To the extent that CFRG's imprimatur will enourage
IEEE802.11 adoption of Dragonfly, CFRG should *not* bless Dragonfly.

Let's review:

IEEE802.11 adopted WEP despite best practices suggesting that the
protocol, as designed, should not be used.  As far as I know, no one
knew how to break it when it was adopted, but no one had a compelling
argument that it couldn't be broken.

WEP was later upgraded to WPA2 (I'm ignoring TKIP and friends).  There
was no security proof for WPA2, but it seemed good enough, especially
given the contraints at the time.  IIRC it ended up being considerably
weaker than hoped.

Now apparently Dragonfly is being proposed.  At least Dragonfly claims
to have the right security properties.  But, from reading all the
discussion here, it seems that Dragonfly is only unbroken because the
issues in early drafts were fixed and the known attempts to attack it
don't work.

But this is ridiculous for a new protocol.  There are multiple simple
protocols with security proofs, *especially* for balanced PAKEs.
There are the various SPAKE flavors, J-PAKE, and (my favorite because
it's so simple) DH-EKE.

If CFRG wants to publish the Dragonfly draft with a statement that
Dragonfly is not recommended for new designs, that's one thing.  But
publishing it as is, especially if that will be seen as a sign that it
is appropriate to use in new designs, seems dangerous.

--Andy