Re: [Cfrg] Forward secrecy of SPAKE2

[Wasa Bee <[e-mail]>]

Hi

AFAIK, PFS has two components (I recall a presentation by Hugo Krawczyk but
I don't remember which conference):
- long term key compromise does not break the security of past
communications.
That's what the paper shows (long-term key = password)
- short term key compromise (eg ephemeral DH private key, session key) does
not break the security of future sessions. I don't think this holds for
PFS-SPAKE2, i.e., an attacker who recovers the DL of the public DH share
can recover the password, and impersonate the participants thereafter:

1) -> Imagine an attacker sends X* = g^x (instead of the intended X* =
g^x.M^p, since he does not know the password p).
2) <- The victim Bob computes (X*/M^p)^y = g^xy / M^yp = K, and sends Y* =
g^y - Note this is different from the original SPAKE2 where Bob sends
g^y.N^p. Bob also sends the confirmation message H1(C, S, X∗, Y, K, p).

If the attacker subsequently manages to recover the ephemeral exponent y
for Y*, then he can offline brute force the password p, by trying all
(low-entropy) passwords p_guess such that:
H1 = H1_guess(C, S, X*, Y, g^xy/M^yp_guess, p_guess)
C, S, X* and Y are publicly available
x is generated by attacker so is known to him
y is known as per assumption
=> only unknown is p

The attacker now knows the password and can impersonate as Alice or Bob.
Note this works because password have low entropy.

Note that for the original SPAKE2, if y leaks, then there is a similar
problem. However in the original SPAKE2 protocol, g^y in never transmitted.
What's transmitted instead is g^y.N^p (by Bob, phase 2 above), so I don't
think the attacker can recover y since he does not even sees g^y - at least
it seems more difficult. So to me SPAKE2 can withstand a stronger attacker
model in this scenario: an attacker must break into Bob's computer and
recover his volatile memory to get y. At this point's it's probably easier
for the adversary to recover p itself so this is an acceptable scenario,
IMHO...

Did I miss something?

Any thoughts?



On Wed, Sep 4, 2019 at 1:48 PM Björn Haase <[e-mail]> wrote:

> Dear Watson,
>
>  >I overlooked https://eprint.iacr.org/2019/351.pdf in my
>
> >earlier discussions of SPAKE2.
>
> Yes. You might also have overlooked my post from July 19th :-).
>
> https://mailarchive.ietf.org/arch/msg/cfrg/28La-UQyKqpDyaLeIZ_ikD5ccoY
>
> Yours, Björn
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>