Re: [Cfrg] using hash2curve in a protocol

[Dan Harkins <[e-mail]>]

   Hi Mathy,

On 8/10/19 8:57 AM, Mathy Vanhoef wrote:
> Because similar changes are also being proposed in an update to the
> Wi-Fi standard, one remark is that in the simplified_swu and
> hash_to_ffc routine you can use PBKDF2 or similar instead of HKDF.
> This will make possible brute-force attacks (e.g. due to
> implementation issues or other side-channels) more costly. Since these
> routines only have to be executed when configuring the password, and
> not in every run of the handshake, the added overhead should be
> manageable.
   Given that hash_to_element() takes the password as the only
parameter there is nothing to prevent rainbow tables from being
generated based on the "X most popular" passwords (where X is 100 or
1000 or whatever). In fact, it's a given that they will be generated
(this was done in the "Wi-Fi standard" you refer to). So any benefit
you propose seems mostly imaginary.

   A KE is a PAKE when the advantage that an adversary gains is through
interaction (on-line) instead of through computation (off-line). But if
the individual act of testing a password is based on a rainbow table
then it doesn't matter whether PBKDF2 was used or whether just HKDF was
used. The attack will simply run through a table of predetermined elements.
It will just be done on-line.

   The key in using a PAKE is to make sure your password is not guessable
(which is a MUCH lower bar than saying it must be a "random n-bit PSK" *).
Since an attack against a PAKE requires repeated active attacks (instead
of just number crunching off-line) there is a benefit since it constrains
attacks and forces them to be detectable, but there really isn't much of
a gain by trying to increase the unit cost of each guess. Unless I'm
missing something. What am I missing?

   regards,

   Dan.

* think of the example of a PSK being a number chosen uniformly such that
1 < PSK < 1,000,000. In a (non-PAKE) PSK exchange this will be successfully
attacked, in a matter of seconds, with a probability of 1, but with a PAKE
it will require 500,000 active attacks until probability reaches 0.5. That
is the benefit, not the unit cost of each guess.