Re: [Cfrg] aPAKE Analysis / Why System-Level-View

[Natanael <[e-mail]>]

Den ons 18 sep. 2019 13:51Jonathan Hoyland <[e-mail]>
skrev:

> Hi Björn,
>
> I think the aPAKE candidates analysed in the UC model are taking the right
> approach. I think it would be valuable for as
> to give them composable features such that it is well defined how to bind
> them to other protocols, and how to bind other
> protocols to them. If we can define a channel binding for the aPAKE and
> further allow the aPAKE to commit to ancillary
> data then are well on our way to making it a useful primitive.
>

I'd like to note that the U2F spec has a channel binding option. IIRC it
derives a session ID (or equivalent value) from the TLS key exchange and
commits to it.

Reference;
https://fidoalliance.org/fido-technotes-channel-binding-and-fido/

Unfortunately it isn't implemented in any U2F compatible browser - only
Chrome used to support it, but then they later removed it (citing
complexity, although I believe the security benefit justifies it). Firefox
never supported it. Hopefully it will regain support. But regardless, the
approach used in that spec might be a good starting point here too?

And a sidenote: as I've mentioned before, I'd really like to see a PAKE
protocol and a 2FA protocol like U2F being supported together. If both of
these protocols would also have proper channel binding, then this would
offer significantly improved security without sacrificing usability.

Being able to trigger a PAKE from a button press on your 2FA hardware token
would also be a significant UX improvement over many of the other options
with similar security level.