Re: [Cfrg] The SESPAKE protocol and PAKE requirements

[Schmidt, Jörn-Marc <[e-mail]>]

Hello Stanislav,

You're right, the two points are not precise enough - my sentence was too sloppy. I'll use your suggestion for the active adversary. I think it covers also passive adversaries - if eavesdropping leads to any information about the password, there is no "guess" needed. Which reminds me that "guess" is again not the best term - I'll use something like "interaction with legitimate parties"..

Thanks a lot!

Best regards,

Jörn

----
>Two points must be corrected in the sentence (2):
>- not "divided by the password length", but "divided by the cardinality of the set of possible passwords" (for example, if you use passwords of digits 0-9 of length 8, the probability of success for 3 trials is estimated not as 3/8, but as 3/(10^8)).
>- not "limited by [the number...divided...]", but something like "limited by [the number...divided...] plus a negligible value" (it is always a possibility with a negligible probability, that adversary breaks a CDH instance etc).


>Moreover, since the requirement (1) in your statement can be trivially achieved without any PAKE (if you just use simple DH without any passwords, it's OK for the case of a passive adversary), I'd prefer to modify your statement in this way:
>"In particular, the proof must show that the probability of an active adversary to (1) pass authentication or (2) to learn anything about the password or (3) to learn anything about the established key is limited by the number of guesses divided by the ...."