Re: [Cfrg] SESPAKE password-authenticated key exchange protocol

["Stanislav V. Smyshlyaev" <[e-mail]>]

Dear colleagues,

To make our contribution in the process with PAKE protocols, we've
published a SESPAKE Internet Draft:
https://tools.ietf.org/html/draft-smyshlyaev-sespake-00.

The original document with SESPAKE is now an official document in the
Russian standardization system: it was approved by the Russian
standardization system (ROSSTANDART) Technical Committee on Cryptography
(TC26) on 26 of November 2015.

The current draft is based on the Russian algorithms only, but we are ready
to widen it for the multi-algorithm support if it is considered necessary.
The description of the protocol in the current draft is given in text form;
a scheme is presented in my previous message.

We are in process of translating our security proofs now – we hope to
publish the document with the proofs on ePrint in the middle of December.


Best regards,
Stanislav V. Smyshlyaev, Ph.D.,
Head of Information Security Department,
CryptoPro LLC


2015-11-02 16:55 GMT+03:00 Stanislav V. Smyshlyaev <[e-mail]>:

> Dear colleagues,
>
> We would like to take part in the process with PAKE protocols. We would
> like to draw your attention to the protocol that is used (for a few years
> already) in Russian cryptographic products (for the most relevant example
> of a popular product, wireless cryptographic tokens).
>
> It is a processed document (in an editorial part now) in the Russian
> standardization system; we've got a full security proof of the protocol
> (including key authentication part); .
>
> During standardization process in Russia the protocol was named SESPAKE
> (security evaluated standardized) – we are planning to continue using this
> abbreviation in our future letters and documents regarding to it.
>
> In the current letter we provide a sketch description of the protocol. If
> you do not mind, in a short time we will present a translated English
> version of the security proof and considerations on connections between the
> proposed protocol, the existing PAKE drafts (AugPAKE, SPAKE2, requirements)
> and other PAKE schemes.
>
> We would be grateful for any comments and for taking part in the process
> with considering SESPAKE protocol in CFRG/IRTF/IETF.
>
>
>
> A stores:                          |         |   B stores:
>  * PW                              |         |    * ind in {1,...,N}
>  * A_ID                            |         |    * salt
>  * {Q_1, ..., Q_N}                 |         |    * QB_PW (or PW and Q_ind)
>
> =================================================================================
>            A                       |         |               B
>
> =================================================================================
>                                    |  A_ID   |
>                                    |-------->|
>                                    |         |
>                                    |ind,salt |
>                                    |<--------|
>                                    |         |
>  * w = int( F(PW, salt) )          |         |
>  * QA_PW = w * Q_ind               |         |
>  * z_A = 0                         |         |
>  * a = random from {1,...,q-1}     |         |
>  * u_1 = a * P - QA_PW             |         |
>                                    |   u_1   |
>                                    |-------->|
>                                    |         | * if u_1 not on E
>                                    |         |   => FINISH
>                                    |         | * Q_B = u_1 + QB_PW
>                                    |         | * z_B = 0
>                                    |         | * b = random from
> {1,...,q-1}
>                                    |         | * if (m/q) * Q_B == 0_E
>                                    |         |   => Q_B = P
>                                    |         |   => z_B = 1
>                                    |         | * src = ( (m/q) * b mod q )
> * Q_B
>                                    |         | * K_B = H_256(src)
>                                    |         | * u_2 = b * P + QB_PW
>                                    |   u_2   |
>                                    |<--------|
>  * if u_2 not on E                 |         |
>    => FINISH                       |         |
>  * Q_A = u_2 - QA_PW               |         |
>  * if (m/q) * Q_A == 0_E           |         |
>    => Q_A = P                      |         |
>    => z_A = 1                      |         |
>  * src = ( (m/q) * a mod q ) * Q_A |         |
>  * K_A = H_256(src)                |         |
>
> ---------------------------------------------------------------------------------
>  * src_MAC =                       |         |
>    = TA||A_ID||ind||salt||u_1||u_2 |         |
>  * M_A = HMAC_{K_A}( src_MAC )     |         |
>                                    |   M_A   |
>                                    |-------->|
>                                    |         | * srcA_MAC =
>                                    |         |   =
> TA||A_ID||ind||salt||u_1||u_2
>                                    |         | * M = HMAC_{K_B}( srcA_MAC )
>                                    |         | * if ( M != M_A ) or ( z_B
> != 0 )
>                                    |         |   => FINISH
>                                    |         | * src_MAC =
>                                    |         |   =
> TB||A_ID||ind||salt||u_1||u_2
>                                    |         | * M_B = HMAC_{K_B}( src_MAC
> )
>                                    |   M_B   |
>                                    |<--------|
>  * srcB_MAC =                      |         |
>    = TB||A_ID||ind||salt||u_1||u_2 |         |
>  * M = HMAC_{K_A}( srcB_MAC )      |         |
>  * if ( M != M_B ) or ( z_A != 0 ) |         |
>    => FINISH                       |         |
>                                    |         |
>
>
>
>
> Best regards,
> Stanislav V. Smyshlyaev, Ph.D.,
> Head of Information Security Department,
> CryptoPro LLC
>