Re: [Cfrg] PAKE Selection Process: Round 2, Stage 2

On Mon, Dec 9, 2019 at 4:44 AM Stanislav V. Smyshlyaev <smyshsv@gmail.com>
wrote:

> Dear CFRG,
>
> According to the plan of Round 2 of the PAKE selection process, additional
> questions for all four remaining candidates have been collected from CFRG
> participants (and Crypto Review Panel members) via crypto-panel@irtf.org .
>
> We've obtained the following list of questions:
> 1) (to SPAKE2): Can you propose a modification of SPAKE2 (preserving all
> existing good properties of PAKE2) with a correspondingly updated security
> proof, addressing the issue of a single discrete log relationship necessary
> for the security of all sessions (e.g., solution based on using
> M=hash2curve(A|B), N=hash2curve(B|A))?
>

Yes: See https://github.com/kaduk/spake2/pull/10 and for the security
proof,  https://eprint.iacr.org/2019/1194. I'll submit it shortly, but this
should indicate where we are going.

2) (to CPace and AuCPace): Can you propose a modification of CPace and
> AuCPace (preserving all existing good properties of these PAKEs) with a
> correspondingly updated security proof (maybe, in some other security
> models), addressing the issue of requiring the establishment of a session
> identifier (sid) during each call of the protocol for the cost of one
> additional message?
> 3) (to all 4 remaining PAKEs) : Can the nominators/developers of the
> protocols please re-evaluate possible IPR conflicts between their
> candidates protocols and own and foreign patents? Specifically, can you
> discuss the impact of U.S. Patent 7,047,408 (expected expiration 10th of
> march 2023) on free use of SPAKE2 and the impact of EP1847062B1 (HMQV,
> expected expiration October 2026) on the free use of the RFC-drafts for
> OPAQUE?
>

I'm not a patent lawyer, or any kind of lawyer. This sounds like a question
for a patent lawyer, rather then uninformed speculation on the list.

4) (to all 4 remaining PAKEs) What can be said about the property of
> "quantum annoyance" (an attacker with a quantum computer needs to solve
> [one or more] DLP per password guess) of the PAKE?
>

I'll have to look at the papers some more. Will answer in a few days.

5) (to all 4 remaining PAKEs) What can be said about "post-quantum
> preparedness" of the PAKE?
>

There isn't a great answer here for SPAKE2 AKAIK. Postquantum primitives
don't smoothly translate point addition or group laws.

> Please let the chairs and the Crypto Review Panel members know (before
> December, 17th) if any questions (collected via  crypto-panel@irtf.org)
> have been lost or misinterpreted (or something needs to be added).
>
> Best regards,
> Stanislav,
> CFRG Secretary
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>