Re: [Cfrg] I-D Action: draft-irtf-cfrg-dragonfly-03.txt

[Yoav Nir <[e-mail]>]

On Feb 4, 2014, at 3:08 AM, Watson Ladd <[e-mail]<mailto:[e-mail]>> wrote:



> I would like to reverse the question.
>
>
>
> Watson, in your technical analysis of the
>
> protocol in its current form (draft-irtf-cfrg-dragonfly-03.txt),
>
> can you identify any exploitable security flaw specific to
>
> the protocol?

Yes: an algorithm exists that guesses passwords in time 2^40. I can't exhibit it, but it exists. JPAKE doesn't have this issue.

2^40 times doing what?  Is it 2^40 calculations based on a single observed authentication?  Observing 2^40 successful authentications?  Actively interacting 2^40 times with the authentication server?

For password-based authentication, these are totally different things, because most passwords come from a 16-bit pool, and nearly all come from a 24-bit pool ([1]). That means that they are very vulnerable to active guessing, which is why pretty much every application limits an attacker's guessing using timeouts.

So what kind of attack is it that you can't exhibit?

Yoav


[1] http://www.maths.tcd.ie/~dwmalone/p/www2012-slides.pdf