[Cfrg] PAKEs for IoT

[Hannes Tschofenig <[e-mail]>]

Hi all,

I was asked to do an analysis of the proposed PAKEs for IoT. I know I am very late with doing that. I tried but I ran into a few problems:

First, it is not clear whether there are any specific requirements for the use of PAKEs in IoT because performance concerns are less applicable. PAKEs are used largely for onboarding where user interaction is required. This reduces the need for low latency because (a) users tend to be slower than machines and (b) large network load due to mass (automatic) onboarding appears to be a non-issue.

Second, I had a hard time finding performance data for the proposals. Getting an understanding of the required code size & ram size on embedded devices would also be super useful.

Third, it remains to be seen whether new PAKEs will get adopted by SDOs working on IoT for two reasons: (1) There is a push from governments not to use passwords on IoT devices (irrespectively of whether they are using PAKEs or not; a distinction that is not understood by users anyway.) (2) There are two PAKEs deployed already, namely JPAKE (in Thread) and Dragonfly (for use with WiFi security). At least in Thread, the effort wasn't very successful because we have other technologies that give us better properties without bothering the user.

Ignoring the third item, I was wondering whether someone can help me with my analysis by pointing to performance data or code (ideally from those working on the proposals).

Ciao
Hannes
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.