Re: [Cfrg] Proposed PAKE Selection Process

["Crockett, Eric" <[e-mail]>]

AWS is interested in PAKE. Of the options we've reviewed, OPAQUE appears to be the best fit for us. However, the lack of standardization of OPAQUE or any other provably secure augmented PAKE scheme has slowed our adoption of PAKE, so we look forward to a CFRG recommendation. I've listed a few things that we are looking for in a PAKE scheme for use at AWS: 

1. We would like to see the standardization of both a standalone scheme and its integration into TLS, similar to SRP (RFCs 2945 and 5054) or OPAQUE (https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-01 and https://tools.ietf.org/html/draft-sullivan-tls-opaque-00).

2. We would like clear IPR statements for any selected schemes, and would prefer a scheme that is completely unencumbered.

3. We would prefer a scheme with a security proof in the strongest model possible. Precomputation security is a plus.

4. Opaque (https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-01#section-2.1), and probably other schemes, support client-side iterated hashing, e.g., with Scrypt. We would like to see recommendations on using iterated hashing on PAKE clients.

5. We would like a scheme that explains how to avoid a user enumeration attack. Both SRP and OPAQUE do this.

6. Our primary use of PAKE would benefit from an augmented, rather than balanced, PAKE scheme.

Thanks,
Eric Crockett | Applied Scientist - Cryptography | [e-mail]