Re: [Cfrg] I-D Action: draft-irtf-cfrg-dragonfly-03.txt

[Watson Ladd <[e-mail]>]

On Feb 4, 2014 11:41 AM, "Robert Ransom" <[e-mail]> wrote:
>
> On 2/4/14, Dan Harkins <[e-mail]> wrote:
>
> >   This is mentioned in section 6.3 of RFC 5931 (dragonfly as an EAP
> > method), knowledge of r where PE = r * G can enable a dictionary
> > attack. But knowledge of r requires doing a discrete logarithm. A
discrete
> > logarithm is assumed to be "computationally infeasible" and you're
talking
> > about doing 2^40 of them!?!
>
> <http://cr.yp.to/papers.html#nonuniform> is relevant here.  It
> discusses several other ‘attacks’ of this general type, and explains
> why they should not be taken seriously.

Bernstein actually argues that one should define complexity measures to
exclude such attacks. This is clear in the paper. Unfortunately time memory
product for the weak password variation is only 2^40.

The problem with foundations of hashing usually isn't a real problem: one
can sign r,H (r, m) with r random to bypass it.

This attack is interesting because of the limits it puts on reductions,
which are the main tool for doing cryptography. If dragonfly could be shown
to have no other weaknesses this would be fine, but no such proof is
forthcoming.

Such a proof would be in the ROM, but as the IETF 88 slides show it would
be tricky.
>
>
> Robert Ransom