Re: [Cfrg] Wi-Fi Alliance Device Provisioning Protocol (DPP) - Draft Released for Public Review and Comments

[Paul Lambert <[e-mail]>]

>>
>> The specification for PKEX is available in two parts:
>> 1) the base SAE protocol is described in IEEE 802.11
>> 
>>	http://www.ieee802.org/11/private/Draft_Standards/11mc/Draft%20P802.11RE
>>Vm
>> c_D8.0.pdf
>   PKEX has nothing to do with the SAE protocol.

PKEX is a direct extension (PAKE+Auth) of the PAKE processing used by SAE.

>And it is not even in the
>draft REVmc document you refer to.

PKEX uses cryptographic processing defined by SAE in REVmc (some open
documentation of SAE is in RFC7664).

One specific example is the definition in PKEX of the “PWE”. The PWE is
used in the 802.11ai specification, but the definition of the acronym and
the cryptographic processing is contained in the IEEE 802.11mc
specification. The PKEX text (Section 12.7.12.4.1 Initial provisioning for
PKEX) references text in 802.11mc (Section 12.4.4.2.2 Generation of the
password element with ECC groups) that defines the detailed processing of
hunt-and-peck algorithm for the PAKE processing (Section 12.4
Authentication with a password).

PKEX and SAE share the same text for “Authentication with a password"

Yes, PKEX is not in 802.11mc, but it refers to very significant processing
defined in 802.11mc.

Yes, PKEX is not SAE, but they share the same underlying PAKE
cryptographic processing

To understand the PKEX cryptographic processing you MUST have access to
both 802.11ai (188 page specification) and 802.11mc (3,774 page
specification). This is a very large issue for the casual reviewer. Even
with both specifications, parsing out the cryptographic processing from
the verbose 802.11 document is difficult.
				
			
		
	

...

>>>> A well designed short authentication string system (e.g. ZRTP's)
>>>> should have no such issues.
>> Interesting Š yes, a short authentication string is good idea for some
>> user cases (Rich-UI device to Rich-UI device). I¹ll look at it some
>>more Š
>   That is exactly the case here. A short authentication string is used to
>bootstrap trust in a peer's public key.

ZRTP defines a short authentication string (SAS) as a unique string
derived from a shared secret created by a DH exchange. Users may validate
the correctness of the string on both ends of the channel. A PAKE requires
a preexisting shared secret that must be exchanged in an out-of-band
manner.  A PAKE is not a SAS and each has significantly different system
and user experience implications.

Paul




>
>   Dan.
>> Paul
>>
>>
>> _______________________________________________
>> Cfrg mailing list
>> [e-mail]
>> https://www.irtf.org/mailman/listinfo/cfrg
>