Re: [Cfrg] Wi-Fi Alliance Device Provisioning Protocol (DPP) - Draft Released for Public Review and Comments

[Paul Lambert <[e-mail]>]

Hi Andy,

Thank you very much for taking the time to look at the DPP specification.

On 8/30/16, 4:37 PM, "Andy Lutomirski" <[e-mail]> wrote:

>On Fri, Jul 29, 2016 at 6:27 PM, Paul Lambert <[e-mail]> wrote:
>> The Wi-Fi Alliance (WFA) has posted a draft version of a new Œsetup
>> protocol¹:
>>
>> 
>>https://www.wi-fi.org/downloads-registered-guest/Wi-Fi_DPP_Tech_Spec_v0_0
>>_23.pdf
Note - this download site is off-line today Š may be back soon.

>>
>>
>> The WFA is looking for review and comments on this specification.
>>
>
>A few comments on a cursory reading:
>
>Section 3.2 specifies a particular point format.  Is this actually
>compatible with Curve 25519, etc?
No it is not.

>Wouldn't it be more sensible to use
>the point format recommended by each individual curve?

Yes - I would think we should always consider such values to be opaque
octet strings and the interpretation should be based on the algorithm
suite. Curve 25519 may not be able to be integrated because of:
 - big versus little endian
 - the ³curve" identification method

The hash algorithms are also locked down to SHAxxx and encryption to
AES-SIV so algorithm flexibility is limited.

>
>Section 5.5: Is the PKEX protocol publicly documented anywhere?  I'm
>concerned that the crypto here is highly suboptimal.

Yes, I¹m not a fan of PKEX in DPP and tried to have it removed. It¹s not
been well reviewed, it¹s really hard to review (due to embedding in
802.11) and it¹s just the wrong mechanism (PAKE) for the desired user
experience.
However,it an interesting design where a PAKE has been extended to provide
both peers with authenticated public keys.  The shared passphrase
effectively introduces two longer term pubic keys. It¹s a significant
design improvement over a typical PAKE that only establishes a shared
symmetric key. PKEX should get some review and get used where appropriate
or we should be working on similar extensions to PAKEs to authenticate
long term public keys.

The specification for PKEX is available in two parts:
1) the base SAE protocol is described in IEEE 802.11
	http://www.ieee802.org/11/private/Draft_Standards/11mc/Draft%20P802.11REVm
c_D8.0.pdf 
	This is a IEEE 802.11 member private site, but I¹ve gotten agreement from
the chair that he will provide access to "security researchers²
	You¹ll have to contact Adrian Stevens (IEEE 802.11 Chair -
[e-mail]) to get the private area password
2) the extension to create PKIX is in IEEE 802.11ai (fragments of text
that will later be incorporated into 802.11)
	This is also on the private site:
http://www.ieee802.org/11/private/index.shtml

IEEE 802.11 keeps draft specifications private, but the contribution
archive is open: https://mentor.ieee.org/802.11/documents
You can see some of it¹s structure by looking at:
https://mentor.ieee.org/802.11/documents?is_dcn=PKEX


> For example, the
>text mentions that:
>
>> Using this bootstrapping technique more than once with a different code
>>but the same bootstrapping key can enable a dictionary attack (to
>>recover the code) by the entity that obtained the bootstrapping key the
>>first time.
>
>A well designed short authentication string system (e.g. ZRTP's)
>should have no such issues.
Interesting Š yes, a short authentication string is good idea for some
user cases (Rich-UI device to Rich-UI device). I¹ll look at it some more Š

Paul


>