Re: [CFRG] Attack on a Real World SPAKE2 Implementation

[Peter Gutmann <[e-mail]>]

Ruben Gonzalez <[e-mail]> writes:

>We did not attack SPAKE2 directly, but a faulty implementation.

Nice work!  This is an example of what I once referred to as second-order
snake oil crypto, good crypto applied badly (first-order is bad crypto).  It's
also at least as deadly as first-order snake oil because now the attacker has
a beacon to guide them to where the insecurities are: Ignoring the great mass
of other code, look for where the crypto is done and then find the flaw in how
it's applied.

(This makes the job of doing crypto audits much, much easier, at least in the
sense that it makes it easy to demonstrate the value of performing the audit
to whoever commissioned it.  Seeing AES-GCM or some other RC4-equivalent and
ECDH practically guarantees a useful result).

Peter.