Re: [Cfrg] Dragonfly has advantages

[Feng Hao <[e-mail]>]

Hi Paul,

On 06/01/2014 00:04, "Paul Lambert" <[e-mail]> wrote:

>
>
>> -----Original Message-----
>> From: Feng Hao [mailto:[e-mail]]
> 
>
>Hi Feng,
>
>> >I agree that it has more complexity and message exchanges that other
>> >approaches.  These other protocols have NOT been viable to ship in the
>> >products I build.
>> 
>> Have you looked at J-PAKE? It's a balanced PAKE, same as Dragonfly.
>No, not in too much detail, yet ... looks of similar complexity.


Well, if you look into the protocol and the proofs, you may realize that
J-PAKE is designed for "simplicity" rather than "complexity".

It is my belief that keeping things simple (which should include the
protocol specification, security proofs and implementation) should be the
the most important consideration in the design of security protocols. Some
people may not realize it, but the hardest task in designing a security
protocol is actually to "keep it as simple as possible".
 

>> 
>> http://www.lightbluetouchpaper.org/2008/05/29/j-pake/	
>Interesting, thanks for the reference.
>
>I assume this is a related better spec for this forum:
>http://tools.ietf.org/search/draft-hao-jpake-00

Yes. Also note that the protocol has remained unchanged from its initial
publication in 2008.

>
>Seems like the identical problem space as Dragonfly, but a later attempt.
>Less critical review so far ...


Not sure if it's a later attempt, but J-PAKE was first published in 2008.
It may not be obvious to some, but the protocol has actually been
extensively analyzed by researchers in the security community and the
industry in the past 5 years. We patiently waited for 5 years to give the
public ample time to scrutinise the protocol and the proofs, and so far no
attacks has been found.

But as always, I welcome most critical reviews from people on this list.
Feel free to post your comments on the lightbluetouchpaper blog, which is
open to everyone to comment.

>
>Note - a nearly identical version of Dragonfly	 is baked into mesh
>networking ... so I still want to see Dragonfly progress to ensure the
>side-channel implementation details and the like are clarified to fully
>address the comments.

Of course. I think a prototype implementation of Dragonfly (in c or Java
etc) would help clarify a lot of things.

>
>Regards,
>
>Paul
>
>> 
>> In the update of "2013-12-30", you can find a prototype implementation
>> of J-PAKE using the elliptic curve group setting.
>> 
>> Cheers,
>> Feng
>