Re: [Cfrg] I-D Action: draft-irtf-cfrg-dragonfly-03.txt

["Dan Harkins" <[e-mail]>]

On Tue, February 4, 2014 8:01 am, Watson Ladd wrote:
> On Tue, Feb 4, 2014 at 12:20 AM, Yoav Nir <[e-mail]> wrote:
>>
>> On Feb 4, 2014, at 3:08 AM, Watson Ladd <[e-mail]> wrote:
>>
>>> I would like to reverse the question.
>>> Watson, in your technical analysis of the
>>> protocol in its current form (draft-irtf-cfrg-dragonfly-03.txt),
>>> can you identify any exploitable security flaw specific to
>>> the protocol?
>>
>> Yes: an algorithm exists that guesses passwords in time 2^40. I can't
>> exhibit it, but it exists. JPAKE doesn't have this issue.
>>
>>
>> 2^40 times doing what?  Is it 2^40 calculations based on a single
>> observed
>> authentication?  Observing 2^40 successful authentications?  Actively
>> interacting 2^40 times with the authentication server?
>
> p calculations, where p is the number of passwords, after conducting
> one round with the authentication
> server.
>
> The algorithm takes the p discrete logarithms of the password elements
> with respect to some base, and uses them
> to identify the password that leads to the confirmation being sent.
> Concretely, the attacker sends g^x, receives g^y
> and guesses p that makes g^(xyp^{-1}) the key going into the confirmation.

  This is mentioned in section 6.3 of RFC 5931 (dragonfly as an EAP
method), knowledge of r where PE = r * G can enable a dictionary
attack. But knowledge of r requires doing a discrete logarithm. A discrete
logarithm is assumed to be "computationally infeasible" and you're talking
about doing 2^40 of them!?!

> For MODP groups maybe this can actually be turned into an exhibitable
> attack. I don't know: I've not thought about
> it enough. But it is still enough to cause issues as I will explain below.
>
> There is also the fact that in the CK model, where ephermental keys
> are leaked, dragonfly reveals the pssword
> element, and hence the password, in time p. This algorithm can be
> exhibited. It's slightly less interesting, because
> CK is very strong, but apparently people care.

  Well, just define Reveal() to only give the session key, that's what
AugPAKE does-- doing Reveal() does not give W = g^password. Not
that I have proved dragonfly is secure in the CK model, just that the CK
model let's the particular protocol define what is its "session state"
that gets revealed.

  Dan.