Re: [Cfrg] Proposed PAKE Selection Process

[William Whyte <[e-mail]>]

Hi Nick,

I’m involved in writing a standard, ISO 21177, which makes use of some IETF/IRTF building blocks and wanted to use a PAKE. We’re on a slightly tighter timeline than the one described below. Can you (or can CFRG) recommend an “interim” PAKE that could be referenced for the first version of this standard? We would intend to add the final CFRG selection as the recommended PAKE mechanism in a revision of 21177, but for now a stable reference that allows implementers to do interoperable proofs of concept would be great.

William

From: Cfrg <[e-mail]> On Behalf Of Nick Sullivan
Sent: Friday, May 24, 2019 2:39 PM
To: [e-mail]
Subject: [EXT] [Cfrg] Proposed PAKE Selection Process

Dear CFRG,

We’re planning to start the main phase of PAKE selection process. This proposal was developed by Stanislav Smyshlyaev with the support of the CFRG chairs.

In addition to helping drive this PAKE selection process, Stanislav has been selected to the role of Secretary of the CFRG, a position that was previously vacant.

To be 100% sure that the process will be as transparent and effective as possible, we would like to announce the proposed plan of handling the process. If you have any concerns about the plan, please send them to the chairs before 27.05.2019.


Step 1, 01.06.2019-30.06.2019:

·        Call for candidate protocols. Note: the chairs especially encourage to nominate PAKEs that have been discussed in CFRG recently (the list can be found in the slides from IETF 104 CFRG session<https://www.ietf.org/proceedings/104/slides/slides-104-cfrg-pake-selection-01.pdf>, slide 9). Third Party nominations are encouraged.

·        Discussing the list of questions to be asked in addition to the ones that are present in RFC 8125. Starting point for such list of questions can be the questions gathered before IETF 104 (can be found in the slides from IETF 104 CFRG session<https://www.ietf.org/proceedings/104/slides/slides-104-cfrg-pake-selection-01.pdf>, slides 7-8).

Step 2, 01.07.2019-19.07.2019:

·        The designers of the protocols (or persons who volunteered to push them forward) prepare papers with:

a.      expanded answers for all positions of RFC 8125;

b.      their own opinions on additional questions selected at Step 1 (they could be incomplete in some sense – for example, a designer of a PAKE might not be an expert in TLS and might not be able to reply how his PAKE can be incorporated in TLS 1.3).
IETF 105 meeting:

·        The chairs give a review of the progress with the process and make corrections of plans.

·        The chairs enumerate questions (from the list that has been prepared during Step 1) which should be considered by independent reviewers before asking the Crypto Review Panel for reviews and analysis. For instance, it will be important that experts from other WGs consider how certain PAKEs fits into TLS 1.3, or into IoT devices.
Further steps (subject to corrections after IETF 105 meeting).
Step 3, 01.08..2019-15.08.2019:

·        Call for reviewers for the enumerated questions, which require additional consideration.

·        Crypto Review Panel members start the process of verification of security proofs of the candidates (Requirement 2 in RFC 8125).
Step 4, 16.08.2019-15.09.2019:

·        The reviewers who volunteered at step 3 prepare their analysis regarding the assigned questions.

·        Crypto Review Panel members are in the process of verification of security proofs of the candidates (Requirement 2 in RFC 8125).
Step 5, 16.09.2019-30.10.2019:

·        Crypto Review Panel members review all gathered materials on each of the protocols to prepare the final list of verified answers to the positions of RFC 8125 and all additional questions from the list that has been prepared during Step 1.

·        If additional explanations are needed, Crypto Review Panel members ask for them from the designers.

·        Crypto Review Panel members write overall reviews for all candidate PAKEs, based on the materials that have been gathered and verified..
Step 6, 01.11.2019-16.11.2019:

·        CFRG chairs discuss the obtained reviews and make their recommendations to CFRG (or convey to CFRG that they can’t make a recommendation yet).
 IETF 106 meeting:

·        The chairs give a review of the progress with the process and make corrections of plans.

·        If everything is clear:

o   one (or more) PAKEs are selected;

o   the process with CFRG document “Recommendations for password-based authenticated key establishment in IETF protocols” is initiated: all practically important recommendations (parameter selection, protecting implementations against side-channel attacks, handling of counters etc.) must be given there;

o   at this point documents on usage of selected PAKEs in TLS/IPsec/etc. can be developed.


Best regards,
Nick on behalf of Stanislav, Kenny, and Alexey