[Cfrg] PAKE selection process: status after Phase 1 and following steps // Answers regarding AuCPace and CPace

[Björn Haase <[e-mail]>]

Dear CFRG, Dear Stanislav,

as requested I have prepared comprehensive documentation regarding the
questions from Phase 1. For this purpose, I have prepared a new revision
of the AuCPace/CPace paper on the eprint server

https://eprint.iacr.org/2018/286

This revised paper contains all of

- Design guidelines and Adversary model that was considered when
designing AuCPace
- Security proof of CPace and AuCPace
- Performance measurements on constrained hardware
- The information as requested in your Phase 1 status mail (Appendix D)

The advantage of compiling everything together is that all of the
information on the AuCPace and CPace nominations could be found in one
single file. The disadvantage is that the presentation got lengthy. For
the CFRG audience, I would like to suggest to start reading with the
Appendix D first.

Note also that this revised paper shows in Appendix C how to use the
method developed by Jarecki, Krawczyk and Xu for merging the key
features of OPAQUE, the pre-computation attack resistance and defense
against user enumeration attacks into AuCPace.

I would specifically appreciate your feedback regarding the suggestion
of a modular integration strategy for PAKE in transport-layer protocols
such as TLS.

Yours,

Björn