Re: [Cfrg] Round 2 of the PAKE selection process

"Hao, Feng" <Feng.Hao@warwick.ac.uk> Wed, 20 November 2019 10:55 UTC

Return-Path: <Feng.Hao@warwick.ac.uk>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4C8C120854 for <cfrg@ietfa.amsl.com>; Wed, 20 Nov 2019 02:55:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6jfJui9isdgQ for <cfrg@ietfa.amsl.com>; Wed, 20 Nov 2019 02:55:32 -0800 (PST)
Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-eopbgr20055.outbound.protection.outlook.com [40.107.2.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3AA8B120B60 for <cfrg@irtf.org>; Wed, 20 Nov 2019 02:55:29 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=YIPghuhxFLKqW5SZTalcuKBkVlYTpErz+2xqlWdbMrBbK5EZejwuU6Ls4/eOGYir9Rq5IjZgsX+OXvijsv2fInk45eo7xq8qnxrcEtirZ9vppw6rtTORKTD1la5D9wQSaOmJAKZt8GJAUMHoEVRcBo54ciEIWrsctr1qb/b0dfbU+LVfWYRYRjo7pcmLwFzF9UbCK9DAmdcGYNZITcIUsFsFCT3Nqa3VO0R8yZMBQEXT/sOyvWG1DclWqOvkotyaihCiTlQTQMVFacuNw/7kfN9DRSLT6cupOswjozo5HtRY5xzoIUcvLchDjWejVBrPEEM6yizleOIml7pxrV2DSw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rp/qrU38FnHAnMxYNlWkwdpioopbNbH75pe6cR4Ia5E=; b=CFycod/Nv6AqZSGbVXypecO8ayF1QtpwXGYNfub4a6Y7EVteK8yH0zr6W+AWMnj9TrYBjTXsSbv9qD0+5fiDZfKOG9LnvuB2uFQnGnqRzRruZWpVmRQUdyuJKBLluxhSyVMifJM9QeeZ72SG9L+q+lIHtWtcu6bvbIgbB1AEj7KYcMDiANlVMB9IJgEdj9q+1zDnEYr7oiNlgBld8XZ/BXhs8iNhqgZVI3hXZjHNv5YkH686GRRs9DfVBonTh8kXbSTUio+3QFf98BsyQyMVmScPibms5moho51zmpc8FD8MGiAyGSMeWVspy5BccDU1NhdYm4LH5d9VWzX0TMmTNg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=warwick.ac.uk; dmarc=pass action=none header.from=warwick.ac.uk; dkim=pass header.d=warwick.ac.uk; arc=none
Received: from DB7PR01MB5435.eurprd01.prod.exchangelabs.com (20.178.104.28) by DB7PR01MB4153.eurprd01.prod.exchangelabs.com (52.135.133.154) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2474.17; Wed, 20 Nov 2019 10:55:25 +0000
Received: from DB7PR01MB5435.eurprd01.prod.exchangelabs.com ([fe80::e925:ac07:6d27:3073]) by DB7PR01MB5435.eurprd01.prod.exchangelabs.com ([fe80::e925:ac07:6d27:3073%7]) with mapi id 15.20.2474.015; Wed, 20 Nov 2019 10:55:25 +0000
From: "Hao, Feng" <Feng.Hao@warwick.ac.uk>
To: "Stanislav V. Smyshlyaev" <smyshsv@gmail.com>
CC: CFRG <cfrg@irtf.org>, "cfrg-chairs@ietf.org" <cfrg-chairs@ietf.org>
Thread-Topic: [Cfrg] Round 2 of the PAKE selection process
Thread-Index: AQHVn2gUS25dXHzxpEuEV6PoAhn9EKeT2+aAgAAEC4CAAANFgA==
Date: Wed, 20 Nov 2019 10:55:25 +0000
Message-ID: <07E1EA63-A274-4C84-871E-823D14BE4D9C@live.warwick.ac.uk>
References: <CAMr0u6nPQxO5X1Txoeh5X7jN=eHscRCBH0HJW=3tbqUdjn8N4Q@mail.gmail.com> <BA639DCD-B3B9-40BD-AF6D-1A4CE9425A03@live.warwick.ac.uk> <CAMr0u6mDx_NnvJq_LpRZSBkWe707mn=HBrELeXsjYXvTTMtzRw@mail.gmail.com>
In-Reply-To: <CAMr0u6mDx_NnvJq_LpRZSBkWe707mn=HBrELeXsjYXvTTMtzRw@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/10.10.10.191111
authentication-results: spf=none (sender IP is ) smtp.mailfrom=Feng.Hao@warwick.ac.uk;
x-originating-ip: [137.205.238.137]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: edfb72c3-9722-4423-bef9-08d76da8261b
x-ms-traffictypediagnostic: DB7PR01MB4153:
x-ms-exchange-purlcount: 2
x-microsoft-antispam-prvs: <DB7PR01MB41530E5D8995EBBFB71449BED64F0@DB7PR01MB4153.eurprd01.prod.exchangelabs.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-forefront-prvs: 02272225C5
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(366004)(136003)(39860400002)(346002)(376002)(396003)(199004)(189003)(51914003)(6436002)(6486002)(102836004)(81166006)(446003)(6506007)(33656002)(8676002)(8936002)(81156014)(6246003)(2906002)(53546011)(186003)(966005)(14454004)(786003)(54906003)(6512007)(6306002)(54896002)(236005)(26005)(478600001)(316002)(413944005)(58126008)(11346002)(1411001)(99286004)(229853002)(91956017)(66066001)(486006)(76116006)(66556008)(66446008)(606006)(25786009)(4326008)(476003)(66946007)(76176011)(66476007)(64756008)(71200400001)(256004)(14444005)(86362001)(71190400001)(5660300002)(7736002)(3846002)(6116002)(6916009); DIR:OUT; SFP:1101; SCL:1; SRVR:DB7PR01MB4153; H:DB7PR01MB5435.eurprd01.prod.exchangelabs.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: warwick.ac.uk does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: ev6W4z0EXRbgRunQm8R6X4xt7d6+wUrr58VnVx0yp2bDNjTirBB7BfFrrgX/xhnplemsckieriIKXFQsZFesi1voC3+MPONz+A/wyfnPIVu/WmvsMg7bN0+Z2CMsyDhR2++3mILKcsn20bVlf5kb8TOlNhZLkiy3sDrNdc7BkN/Q6q5Kow55/BY/9hcKVOAeqAJMcoN0U4Daa7QFB2ps+zT9uaCxubpTBYSDi/Gd6WO9FhJVCyf5gcSX2k9RpDTXMFlOxsiiOngO6nDSXLmmLAfMl4uMnn+FkeW14BCkoz70trDJctVY2Pny4IuzMAPRcN8tuYpOrlfo54iBsJv8Fi8RuJgbUjitzIKqhPp1co4fJ6nxi4EXsVA1u+UNMuBqdkb21XNOYxhg6Wi/5tbpi/KPgkpD8VvD1MIEXDUGFSciOyQjRRsoHFzxX7Jr9G4BvVUY9+JndksUBZjCGqtzOMLGucrJIK2003d/IMrWQdE=
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_07E1EA63A2744C84871E823D14BE4D9Clivewarwickacuk_"
MIME-Version: 1.0
X-OriginatorOrg: warwick.ac.uk
X-MS-Exchange-CrossTenant-Network-Message-Id: edfb72c3-9722-4423-bef9-08d76da8261b
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Nov 2019 10:55:25.6630 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 09bacfbd-47ef-4465-9265-3546f2eaf6bc
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: EPG/omd0MH9ZrKdlgIOgDdjX12U383ug52p/GfeZy2itjyFYRMfS0ypQpJ9TcNvP4mhs1vYKAE7YQE3g/plfK28cemssOLhT2vMhX9ITyDw=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR01MB4153
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/4fDuuFMMgXz-Sxt-NMGEu1YZgwc>
Subject: Re: [Cfrg] Round 2 of the PAKE selection process
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 20 Nov 2019 10:55:37 -0000

Dear Stanislav,

As pointed out in the previous CFRG discussions, some of the comments are based on misunderstanding of PAKE.

It would be helpful to hear the “official” rationale from the review panel on the round 1 results.

Cheers,
Feng

From: "Stanislav V. Smyshlyaev" <smyshsv@gmail.com>
Date: Wednesday, 20 November 2019 at 10:43
To: "Hao, Feng" <Feng.Hao@warwick.ac.uk>
Cc: "cfrg@irtf.org" <cfrg@irtf.org>rg>, "cfrg-chairs@ietf.org" <cfrg-chairs@ietf.org>
Subject: Re: [Cfrg] Round 2 of the PAKE selection process

Dear Feng,

The decision was made based on the Crypto Review Panel member reviews (which in turn were based on partial reviews by independent experts), which are available at
https://github.com/cfrg/pake-selection (see “Overall reviews by Crypto Review Panel”).

Best regards,
Stanislav

ср, 20 нояб. 2019 г. в 18:29, Hao, Feng <Feng.Hao@warwick.ac.uk<mailto:Feng.Hao@warwick.ac.uk>>:
Dear Stanislav (and the review panel),

Many thanks for the update.

For the benefits of openness and transparency, can you give reasons why these four were selected and the rest were removed? I couldn’t find those on your slides.

I’m sure that’ll be helpful for people on the CRFG to understand better this selection process.

Cheers,
Feng

From: Cfrg <cfrg-bounces@irtf.org<mailto:cfrg-bounces@irtf.org>> on behalf of "Stanislav V. Smyshlyaev" <smyshsv@gmail.com<mailto:smyshsv@gmail.com>>
Date: Wednesday, 20 November 2019 at 06:02
To: "cfrg@irtf.org<mailto:cfrg@irtf.org>" <cfrg@irtf.org<mailto:cfrg@irtf.org>>
Cc: "cfrg-chairs@ietf.org<mailto:cfrg-chairs@ietf.org>" <cfrg-chairs@ietf.org<mailto:cfrg-chairs@ietf.org>>
Subject: [Cfrg] Round 2 of the PAKE selection process

Dear CFRG,

As we've announced at the CFRG session today, now we're starting the Round 2 of the PAKE selection process.

We have narrowed down choices to: two balanced (SPAKE2 and CPace) and two augmented (OPAQUE and AuCPace).

Some additional information can be found in my slides from the IETF 106 CFRG meeting:
https://datatracker.ietf.org/meeting/106/materials/slides-106-cfrg-pake-selection-update

Please take a look at the plan and especially at Stage 1 - please send your additional questions to be considered at Round 2 to crypto-panel@irtf.org<mailto:crypto-panel@irtf.org> until December, 5th.

Round 2 of the PAKE selection process
Stage 1: November, 21st - December, 5th
Additional questions for all four candidates are collected from CFRG participants  (and Crypto Review Panel members). The questions can be of one of possible types:
a) Requests for clarifications for the candidate protocols or their proposed modifications (e.g., security of CPace and AuCPace without negotiation of sid, security and convenient of SPAKE2 with a hash2curve function used to obtain M and N for each pair of identifiers).
b) Questions to be taken into account in addition to ones collected at Stage 1 of Round 1 (e.g., quantum annoyance, post-quantum preparedness).
The questions should be sent to crypto-panel@irtf.org<mailto:crypto-panel@irtf.org>.

Stage 2: December, 10th - December, 17th
A list of new questions is published on https://github.com/cfrg/pake-selection; the CFRG is asked whether anything else should be added.

Stage 3: December 25th - February, 10th
The authors of the candidates prepare their replies to the additional questions/requested clarifications.

Stage 4: February, 12th - March, 10th
Crypto Review Panel members prepare new overall reviews (for all 4 remaining PAKEs) taking into account both the reviews obtained on Round 1 and new information obtained during Round 2.

IETF 107:
The CFRG chairs discuss the obtained reviews and make their recommendations to CFRG (or convey to CFRG that they can’t make a recommendation yet).
If everything is clear:
- one (or zero) balanced PAKE is selected;
- one (or zero) augmented PAKE is selected;
- the process with CFRG document “Recommendations for password-based authenticated key establishment in IETF protocols” is initiated: all practically important recommendations (parameter selection, protecting implementations against side-channel attacks, handling of counters etc.) must be given there.

Best regards,
Stanislav Smyshlyaev
CFRG Secretary
--

С уважением,

Станислав Смышляев, к.ф.-м.н.,

Заместитель генерального директора

ООО «КРИПТО-ПРО»