[Cfrg] OPAQUE Status (and the need for 3 msgs)

[Hugo Krawczyk <[e-mail]>]

We have been (and still are) working on improving and refining the proofs
of the OPAQUE paper. Refining proofs in the UC model always involves also
refining the functionalities that define security. Luckily, in this process
the protocol has not changed. However, one of the conclusions of our
analysis is that our AKE functionality (the one we compose with an OPRF)
requires full forward secrecy and therefore we need the AKE not only to be
KCI-secure but also forward secure (FS). While FS is a very desirable
security property of an AKE protocol, it also means that we* cannot have* a
2-message OPAQUE (e.g., the instantiation based on 2-msg HMQV that we
suggested) as any such protocol can have at most weak FS and is open to
attack. Three messages suffice for OPAQUE, as can be obtained with
FS-secure protocols such as HMQV with explicit client authentication or
SIGMA (in its 3- and 4-msg variants).

The above does not change the analysis people have done regarding
integration with TLS and IKE as these integrations already assumed 3
messages (or even 4 in the case of IKE) with explicit user authentication
and full FS. So neither the protocols or the number of flows changes for
these cases.

In addition to this, as I mentioned earlier in this list, we need a
stricter notion of secure  Authenticated Encryption for which we can either
eliminate the encryption all together (deriving p_u directly from rwd) or
realize it with regular AuthEnc tools with RO-type assumptions.

Hugo