Re: [Cfrg] OPAQUE: Secure aPAKE (presentation and draft)

Hello,

Are there any slides of this presentation?

Thanks,
David
On Tue, Jul 17, 2018 at 3:27 PM Christopher Wood
<christopherwood07@gmail.com> wrote:
>
> The PDF link works (for me).
>
> Best,
> Chris
>
> On Tue, Jul 17, 2018 at 6:24 PM, Robert Moskowitz
> <rgm-sec@htt-consult.com> wrote:
> > Hugo,
> >
> > The link below to this draft is not working.  :(
> >
> > Bob
> >
> >
> >
> >
> > On 07/11/2018 03:13 AM, Hugo Krawczyk wrote:
> >
> > During the CFRG meeting in Montreal I will have a short presentation about
> > the OPAQUE protocol, the first PKI-free aPAKE ('a' is for asymmetric or
> > augmented)   to accommodate secret salt and be secure against
> > pre-computation attacks.  In contrast, prior aPAKE protocols did not use
> > salt and if they did, the salt was transmitted in the clear from server to
> > user allowing for the building of pre-computed dictionaries.
> >
> > OPAQUE was presented in a recent paper at Eurocrypt 2018
> > https://eprint.iacr.org/2018/163
> > that includes a full proof of security in a strong aPAKE model that
> > guarantees security against pre-computation.
> >
> > I believe OPAQUE to be a good candidate for standardization as an aPAKE. It
> > compares favorably, both in actual security and proven security, to other
> > aPAKE schemes considered for standardization, including SPAKE2+, AugPAKE and
> > the old SRP. In particular, none of these protocols
> >
> > has
> >  a proof of security (*), not even in a weak model, and none can accommodate
> > secret salt.
> >
> > I have not made the deadline for posting a draft before the IETF meeting so
> > I am posting an unofficial version (that I will submit after the meeting)
> > here:
> > http://webee.technion.ac.il/~hugo/draft-krawczyk-cfrg-opaque-00.txt
> > http://webee.technion.ac.il/~hugo/draft-krawczyk-cfrg-opaque-00.pdf
> >
> > Comments are welcome (although I may be slow in responding)
> >
> > Hugo
> >
> > (*) Clarification: Contrary to what recent drafts have claimed, SPAKE2+ does
> > not have a proof as aPAKE - the protocol was described by Cash et al with a
> > short informal discussion of its rationale and no intention to claim its
> > security formally (the paper does not even contain a security model for
> > aPAKE protocols). This is in contrast to SPAKE2 that does have a proof as
> > PAKE (without the augmented part).
> >
> >
> >
> >
> >
> >
> >
> > _______________________________________________
> > Cfrg mailing list
> > Cfrg@irtf.org
> > https://www.irtf.org/mailman/listinfo/cfrg
> >
> >
> >
> > _______________________________________________
> > Cfrg mailing list
> > Cfrg@irtf.org
> > https://www.irtf.org/mailman/listinfo/cfrg
> >
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg