Re: [Cfrg] [Crypto-panel] Fwd: I-D Action: draft-irtf-cfrg-spake2-12.txt

["Stanislav V. Smyshlyaev" <[e-mail]>]

Scott, Bjoern, are you happy with the changes?

пт, 11 сент. 2020 г. в 20:41, Watson Ladd <[e-mail]>:

> I have just uploaded version -13 which contains suggested text from
>
> Michel by way of Bjorn.
>
>
>
> Given we have per-user M and N as an option I decided not to add
>
> per-protocol, but if Scott thinks it's a good idea I'm happy to add
>
> it: not sure it will be used.
>
>
>
> On Mon, Aug 24, 2020 at 9:03 AM Björn Haase <[e-mail]>
> wrote:
>
> >
>
> > Dear Watson,
>
> >
>
> > If I understood correctly Manuel and Michel's proof, the reduction to
> the GAP version of CDH problem refers only to the "perfect-forward
> security" aspect of the SPAKE2 proofs.
>
> >
>
> > To my best knowledge, the game-based proof regarding the "only one
> password guess per session" feature does rely on "Discrete Logarithm
> Password-based Chosen-basis Computational Diffie-Hellman assumption"
> (DLPWBCDH) (i.e. without the "GAP").
>
> >
>
> > IIRC there is some small margin between the CDH and DLPWBCDH but there
> is no need for the GAP assumption when carrying out the proof in the
> game-based models, except for the forward-security aspect which to my
> knowledge requires the DDH oracle.
>
> >
>
> > For the UC proofs, OTOTH the GAP assumption appears to be mandatory,
> IIUC, since this proof strategy also implies forward security.
>
> >
>
> > I'm in close contact with Michel for the CPace draft preparation and
> I'll ask him what specific wording he would be recommending for your
> document, the next time I'll be talking to him.
>
> >
>
> > Yours,
>
> >
>
> > Björn.
>
> >
>
> >
>
> >
>
> > Mit freundlichen Grüßen I Best Regards
>
> >
>
> > Dr. Björn Haase
>
> >
>
> >
>
> > Senior Expert Electronics | TGREH Electronics Hardware
>
> >
>
> > Endress+Hauser Liquid Analysis
>
> >
>
> > Endress+Hauser Conducta GmbH+Co.KG | Dieselstrasse 24 | 70839 Gerlingen
> | Germany
>
> > Phone: [phone] | Fax: [phone]
>
> > [e-mail] |  www.ehla.endress.com
>
> >
>
> >
>
> >
>
> >
>
> >
>
> > Endress+Hauser Conducta GmbH+Co.KG
>
> > Amtsgericht Stuttgart HRA 201908
>
> > Sitz der Gesellschaft: Gerlingen
>
> > Persönlich haftende Gesellschafterin:
>
> > Endress+Hauser Conducta Verwaltungsgesellschaft mbH
>
> > Sitz der Gesellschaft: Gerlingen
>
> > Amtsgericht Stuttgart HRA 201929
>
> > Geschäftsführer: Dr. Manfred Jagiella
>
> >
>
> >
>
> > Gemäss Datenschutzgrundverordnung sind wir verpflichtet, Sie zu
> informieren, wenn wir personenbezogene Daten von Ihnen erheben.
>
> > Dieser Informationspflicht kommen wir mit folgendem Datenschutzhinweis (
> https://www.endress.com/de/cookies-endress+hauser-website) nach.
>
> >
>
> >
>
> >
>
> >
>
> >
>
> > Disclaimer:
>
> >
>
> > The information transmitted is intended only for the person or entity to
> which it is addressed and may contain confidential, proprietary, and/or
> privileged material. Any review, retransmission, dissemination or other use
> of, or taking of any action in reliance upon, this information by persons
> or entities other than the intended recipient is prohibited. If you receive
> this in error, please contact the sender and delete the material from any
> computer. This e-mail does not constitute a contract offer, a contract
> amendment, or an acceptance of a contract offer unless explicitly and
> conspicuously designated or stated as such.
>
> >
>
> >
>
> >
>
> > -----Ursprüngliche Nachricht-----
>
> > Von: Cfrg <[e-mail]> Im Auftrag von Watson Ladd
>
> > Gesendet: Montag, 24. August 2020 14:42
>
> > An: Scott Fluhrer (sfluhrer) <sfluhrer=[e-mail]>
>
> > Cc: [e-mail]; <[e-mail]> <[e-mail]>; Russ
> Housley <[e-mail]>; [e-mail]
>
> > Betreff: Re: [Cfrg] [Crypto-panel] Fwd: I-D Action:
> draft-irtf-cfrg-spake2-12.txt
>
> >
>
> > On Sun, Aug 23, 2020 at 3:20 PM Scott Fluhrer (sfluhrer)
>
> > <sfluhrer=[e-mail]> wrote:
>
> > >
>
> > > I looked through it (the Crypto20 crypto conference was last week,
> that kept me busy); it looked good, with two nits:
>
> >
>
> > Thank you very much for reviewing it so quickly!
>
> >
>
> > >
>
> > >
>
> > >
>
> > > Section 3.1 states “Lets G be a group in which the computational
> Diffie-Hellman (CDH) problem is hard”.  Actually, if you go through the
> security proof, it appears that the slightly stronger “S-PCCDH assumption”
> is required.  While it is plausible that, for any group where the CDH
> assumption holds, so does the S-PCCDH assumption, however, this is not
> proven.
>
> >
>
> > So recently
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Feprint.iacr.org%2F2019%2F1194.pdf&amp;data=02%7C01%7Cbjoern.haase%40endress.com%7C8359743fd98a4c38077608d8482b33bd%7C52daf2a93b734da4ac6a3f81adc92b7e%7C1%7C1%7C637338697691624309&amp;sdata=TwffvrezUzSnJeaPaahlF08H744LL1mxocrTksHdvo0%3D&amp;reserved=0
> reduces to Gap
>
> > Diffie-Hellman. I think I should revise that sentence of 3.1 and
>
> > discuss in security considerations section exactly what is assumed and
>
> > that elliptic curves in the draft are widely conjectured to satisfy
>
> > it. Hopefully this won't confuse anyone more than necessary.
>
> >
>
> > > This draft still relies on a fixed (per group) M and N values; as we
> have argued before, having a global N and M value menas that breaking one
> discrete problem would mean breaking the entire system globally, and so
> that arguably too attractive as a target.  Assuming that the authors aren’t
> willing to use a Hash2Curve method to generate N, M values, I would
> recommend that a paragraph be added to the document outlining the situation
> (and perferably giving a procedure where individual protocols can select
> their own N, M values)
>
> >
>
> > Section 5:
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fid%2Fdraft-irtf-cfrg-spake2-11.html%23rfc.section.5&amp;data=02%7C01%7Cbjoern.haase%40endress.com%7C8359743fd98a4c38077608d8482b33bd%7C52daf2a93b734da4ac6a3f81adc92b7e%7C1%7C1%7C637338697691624309&amp;sdata=TSxHJGOCsecYGoYp4OwBajfg%2FXt%2F9aLbokD%2F7iKprK0%3D&amp;reserved=0
>
> > has M and N per user, following one of the papers in the references.
>
> > I think a per-protocol option makes sense to add, but it would be nice
>
> > to know if it would be used.
>
> >
>
> >
>
> > >
>
> > >
>
> > >
>
> > > From: Scott Fluhrer (sfluhrer)
>
> > > Sent: Monday, August 17, 2020 7:50 AM
>
> > > To: Stanislav V. Smyshlyaev <[e-mail]>; Russ Housley <
> [e-mail]>; [e-mail]
>
> > > Cc: Alexey Melnikov <[e-mail]>; [e-mail]
>
> > > Subject: RE: [Crypto-panel] Fwd: [Cfrg] I-D Action:
> draft-irtf-cfrg-spake2-12.txt
>
> > >
>
> > >
>
> > >
>
> > > I’ll take a quick look at it.
>
> > >
>
> > >
>
> > >
>
> > > From: Crypto-panel <[e-mail]> On Behalf Of
> Stanislav V. Smyshlyaev
>
> > > Sent: Monday, August 17, 2020 4:40 AM
>
> > > To: Russ Housley <[e-mail]>; [e-mail]
>
> > > Cc: Alexey Melnikov <[e-mail]>; [e-mail]
>
> > > Subject: Re: [Crypto-panel] Fwd: [Cfrg] I-D Action:
> draft-irtf-cfrg-spake2-12.txt
>
> > >
>
> > >
>
> > >
>
> > > Dear Russ, dear Crypto Panel experts,
>
> > >
>
> > >
>
> > >
>
> > > Any volunteers for a quick review of the updated version of the SPAKE2
> draft (before commencing a RGLC)?
>
> > >
>
> > >
>
> > >
>
> > > Regards,
>
> > >
>
> > > Stanislav
>
> > >
>
> > >
>
> > >
>
> > > On Tue, 11 Aug 2020 at 20:02, Alexey Melnikov <
> [e-mail]> wrote:
>
> > >
>
> > > On 11/08/2020 17:47, Alexey Melnikov wrote:
>
> > >
>
> > > Hi Russ,
>
> > >
>
> > > On 11/08/2020 17:43, Russ Housley wrote:
>
> > >
>
> > > > We recommend the following two protocols to be selected as
> «recommended by the CFRG for usage in IETF protocols»: one balanced PAKE -
> CPace, and one augmented PAKE - OPAQUE.
>
> > >
>
> > >
>
> > >
>
> > > What was the point of the selection process if we are going to publish
> the ones that were not selected too?
>
> > >
>
> > > It is needed by Kitten WG for one of Kerberos documents. The idea is
> to publish it with a disclaimer that it predated PAKE selection process and
> was not selected as one of the finalists.
>
> > >
>
> > > To clarify: we don't intend to publish any other PAKE candidates that
> weren't finalists.
>
> > >
>
> > > Best Regards,
>
> > >
>
> > > Alexey
>
> > >
>
> > >
>
> > >
>
> > > Russ
>
> > >
>
> > >
>
> > >
>
> > >
>
> > >
>
> > >
>
> > >
>
> > > On Aug 11, 2020, at 10:57 AM, Stanislav V. Smyshlyaev <
> [e-mail]> wrote:
>
> > >
>
> > >
>
> > >
>
> > > Dear Crypto Panel experts,
>
> > >
>
> > >
>
> > >
>
> > > Could someone please take a quick look at the updated version (taking
> into account the reviews made during the PAKE selection process)?
>
> > >
>
> > >
>
> > >
>
> > > Regards,
>
> > >
>
> > > Stanislav (on behalf of CFRG chairs)
>
> > >
>
> > >
>
> > >
>
> > > ---------- Пересылаемое сообщение ---------
>
> > > От: Watson Ladd <[e-mail]>
>
> > > Дата: пн, 10 авг. 2020 г. в 23:29
>
> > > Тема: Re: [Cfrg] I-D Action: draft-irtf-cfrg-spake2-12.txt
>
> > > Кому: <[e-mail]>
>
> > >
>
> > >
>
> > >
>
> > > This fixes the comment on missing identities received during the PAKE
>
> > > competition which was the only one I found.
>
> > >
>
> > > I think it's ready for RGLC.
>
> > >
>
> > > On Mon, Aug 10, 2020 at 4:27 PM <[e-mail]> wrote:
>
> > > >
>
> > > >
>
> > > > A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
>
> > > > This draft is a work item of the Crypto Forum RG of the IRTF.
>
> > > >
>
> > > >         Title           : SPAKE2, a PAKE
>
> > > >         Authors         : Watson Ladd
>
> > > >                           Benjamin Kaduk
>
> > > >         Filename        : draft-irtf-cfrg-spake2-12.txt
>
> > > >         Pages           : 16
>
> > > >         Date            : 2020-08-10
>
> > > >
>
> > > > Abstract:
>
> > > >    This document describes SPAKE2 which is a protocol for two parties
>
> > > >    that share a password to derive a strong shared key with no risk
> of
>
> > > >    disclosing the password.  This method is compatible with any
> group,
>
> > > >    is computationally efficient, and SPAKE2 has a security proof.
> This
>
> > > >    document predated the CFRG PAKE competition and it was not
> selected.
>
> > > >
>
> > > >
>
> > > > The IETF datatracker status page for this draft is:
>
> > > >
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-irtf-cfrg-spake2%2F&amp;data=02%7C01%7Cbjoern.haase%40endress.com%7C8359743fd98a4c38077608d8482b33bd%7C52daf2a93b734da4ac6a3f81adc92b7e%7C1%7C1%7C637338697691624309&amp;sdata=lfQZ%2Bk58AZtuJDwwoL3kp9h%2B1t6eVh%2BO4IhcPF%2BJA9k%3D&amp;reserved=0
>
> > > >
>
> > > > There are also htmlized versions available at:
>
> > > >
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-irtf-cfrg-spake2-12&amp;data=02%7C01%7Cbjoern.haase%40endress.com%7C8359743fd98a4c38077608d8482b33bd%7C52daf2a93b734da4ac6a3f81adc92b7e%7C1%7C1%7C637338697691624309&amp;sdata=M%2B1R6InBuduuxEehA%2Fmz99McvXt8KnILIj9S2bRBifs%3D&amp;reserved=0
>
> > > >
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-irtf-cfrg-spake2-12&amp;data=02%7C01%7Cbjoern.haase%40endress.com%7C8359743fd98a4c38077608d8482b33bd%7C52daf2a93b734da4ac6a3f81adc92b7e%7C1%7C1%7C637338697691624309&amp;sdata=9IrixLVgOePrXOr4FXNIgwa8x9Jgpldlq5tr55o%2FGgI%3D&amp;reserved=0
>
> > > >
>
> > > > A diff from the previous version is available at:
>
> > > >
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Frfcdiff%3Furl2%3Ddraft-irtf-cfrg-spake2-12&amp;data=02%7C01%7Cbjoern.haase%40endress.com%7C8359743fd98a4c38077608d8482b33bd%7C52daf2a93b734da4ac6a3f81adc92b7e%7C1%7C1%7C637338697691624309&amp;sdata=TI3p%2F1EM4Un4No8%2BEY6KsExVBQyMXIlg6OzWoZFi8%2FU%3D&amp;reserved=0
>
> > > >
>
> > > >
>
> > > > Please note that it may take a couple of minutes from the time of
> submission
>
> > > > until the htmlized version and diff are available at tools.ietf.org.
>
> > > >
>
> > > > Internet-Drafts are also available by anonymous FTP at:
>
> > > >
> https://eur03.safelinks.protection.outlook.com/?url=ftp%3A%2F%2Fftp.ietf.org%2Finternet-drafts%2F&amp;data=02%7C01%7Cbjoern.haase%40endress.com%7C8359743fd98a4c38077608d8482b33bd%7C52daf2a93b734da4ac6a3f81adc92b7e%7C1%7C1%7C637338697691624309&amp;sdata=JLdVl7lCQLtmHJiKclYtzm81ubwwTgRe29PJMfhIPtY%3D&amp;reserved=0
>
> > > >
>
> > > >
>
> > > > _______________________________________________
>
> > > > Cfrg mailing list
>
> > > > [e-mail]
>
> > > >
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg&amp;data=02%7C01%7Cbjoern.haase%40endress.com%7C8359743fd98a4c38077608d8482b33bd%7C52daf2a93b734da4ac6a3f81adc92b7e%7C1%7C1%7C637338697691634306&amp;sdata=oteAqHxVYJtxizv9OX5GP3qfiAuWTpgeZXxZPIlj3z8%3D&amp;reserved=0
>
> > >
>
> > >
>
> > >
>
> > > --
>
> > > "Man is born free, but everywhere he is in chains".
>
> > > --Rousseau.
>
> > >
>
> > > _______________________________________________
>
> > > Cfrg mailing list
>
> > > [e-mail]
>
> > >
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg&amp;data=02%7C01%7Cbjoern.haase%40endress.com%7C8359743fd98a4c38077608d8482b33bd%7C52daf2a93b734da4ac6a3f81adc92b7e%7C1%7C1%7C637338697691634306&amp;sdata=oteAqHxVYJtxizv9OX5GP3qfiAuWTpgeZXxZPIlj3z8%3D&amp;reserved=0
>
> > >
>
> > > _______________________________________________
>
> > > Crypto-panel mailing list
>
> > > [e-mail]
>
> > >
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcrypto-panel&amp;data=02%7C01%7Cbjoern.haase%40endress.com%7C8359743fd98a4c38077608d8482b33bd%7C52daf2a93b734da4ac6a3f81adc92b7e%7C1%7C1%7C637338697691634306&amp;sdata=w0Bf%2F8e3bInXUJ8FckOi5dK%2FRPdY879EkrXP02iaSR4%3D&amp;reserved=0
>
> > >
>
> > >
>
> > >
>
> > > _______________________________________________
>
> > > Cfrg mailing list
>
> > > [e-mail]
>
> > >
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg&amp;data=02%7C01%7Cbjoern.haase%40endress.com%7C8359743fd98a4c38077608d8482b33bd%7C52daf2a93b734da4ac6a3f81adc92b7e%7C1%7C1%7C637338697691634306&amp;sdata=oteAqHxVYJtxizv9OX5GP3qfiAuWTpgeZXxZPIlj3z8%3D&amp;reserved=0
>
> >
>
> >
>
> >
>
> > --
>
> > "Man is born free, but everywhere he is in chains".
>
> > --Rousseau.
>
> >
>
> > _______________________________________________
>
> > Cfrg mailing list
>
> > [e-mail]
>
> >
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg&amp;data=02%7C01%7Cbjoern.haase%40endress.com%7C8359743fd98a4c38077608d8482b33bd%7C52daf2a93b734da4ac6a3f81adc92b7e%7C1%7C1%7C637338697691634306&amp;sdata=oteAqHxVYJtxizv9OX5GP3qfiAuWTpgeZXxZPIlj3z8%3D&amp;reserved=0
>
>
>
>
>
>
>
> --
>
> "Man is born free, but everywhere he is in chains".
>
> --Rousseau.
>
>