Re: [Cfrg] Integration of OPAQUE in IKEv2

[Yoav Nir <[e-mail]>]

> On 12 Sep 2019, at 4:30, Hugo Krawczyk <[e-mail]> wrote:
> 
> Hi Yoav and Valery, 
> 
> thanks for your extensive analysis of the different PAKE candidates. 
> I would like to clarify some issues regarding the way you
> envision the integration of OPAQUE in the context of IKEv2. 
> 
> Let me first refer to Yoav's analysis 
> https://mailarchive.ietf.org/arch/msg/cfrg/PWhIOQKBHapZ1Rpbd7Brr_JFIg8 <https://mailarchive.ietf.org/arch/msg/cfrg/PWhIOQKBHapZ1Rpbd7Brr_JFIg8>
> where he says:
> 
> > OPAQUE spends one round-trip on sending IDi and receiving EnvU and vU.
> > OPAQUE spends another round-trip on the OPRF protocol.
> > OPAQUE spends yet another round-trip for a KE exchange.
> > The final IKE_AUTH flow uses the generated key for the AUTH payloads.
> > Altogether 5 round-trips (or IKE_AUTH exchanges) are needed for user
> > authentication.
> 
> This mimics the modular description in the OPAQUE draft that shows the different
> logical components. However, these components need not be run sequentially but
> rather in parallel, namely, piggybacking the OPRF to any existing AKE protocol.


Thanks, Hugo.  That makes sense.

It also strengthens the conclusion from both Valery and myself that all the proposed PAKEs will work well enough with IKEv2, so that compatibility with IKEv2 should not be a consideration when picking 1 or 2 PAKEs.

Yoav