[Cfrg] OPAQUE: Secure aPAKE (presentation and draft)

[Hugo Krawczyk <[e-mail]>]

​During the CFRG meeting in Montreal I will have a short presentation about
the OPAQUE protocol, the first PKI-free aPAKE ('a' is for asymmetric or
augmented)   to accommodate secret salt and be secure against
pre-computation attacks.  In contrast, prior aPAKE protocols did not use
salt and if they did, the salt was transmitted in the clear from server to
user allowing for the building of pre-computed dictionaries.

OPAQUE was presented in a recent paper at Eurocrypt 2018
https://eprint.iacr.org/2018/163
that includes a full proof of security in a strong aPAKE model that
guarantees security agai​nst pre-computation.

I believe OPAQUE to be a good candidate for standardization as an aPAKE. It
compares favorably, both in actual security and proven security, to other
aPAKE schemes considered for standardization, including SPAKE2+, AugPAKE
and the old SRP. In particular, none of these protocols

​has
 a proof of security (*), not even in a weak model, and none can
accommodate secret salt.

I have not made the deadline for posting a draft before the IETF meeting so
I am posting an unofficial version (that I will submit after the meeting)
here:
http://webee.technion.ac.il/~hugo/draft-krawczyk-cfrg-opaque-00.txt
http://webee.technion.ac.il/~hugo/draft-krawczyk-cfrg-opaque-00.pdf

Comments are welcome (although I may be slow in responding)

Hugo

(*) Clarification: Contrary to what recent drafts have claimed, SPAKE2+
does not have a proof as aPAKE - the protocol was described by Cash et al
with a short informal discussion of its rationale and no intention to claim
its security formally (the paper does not even contain a security model for
aPAKE protocols). This is in contrast to SPAKE2 that does have a proof as
PAKE (without the augmented part).