Re: [Cfrg] PAKEs for IoT

Dear Hannes,

All collected information about the candidates is here:
https://github.com/cfrg/pake-selection

Could you please formulate the corresponding questions to the authors of
the four nominated PAKEs that are to be considered at Round 2 (SPAKE2,
CPace, AuCPace and OPAQUE) and send those questions to crypto-panel@irtf.org
?..

Best regards,
Stanislav

ср, 20 нояб. 2019 г. в 16:36, Hannes Tschofenig <Hannes.Tschofenig@arm.com>:

> Hi all,
>
>
>
> I was asked to do an analysis of the proposed PAKEs for IoT. I know I am
> very late with doing that. I tried but I ran into a few problems:
>
>
>
> First, it is not clear whether there are any specific requirements for the
> use of PAKEs in IoT because performance concerns are less applicable. PAKEs
> are used largely for onboarding where user interaction is required. This
> reduces the need for low latency because (a) users tend to be slower than
> machines and (b) large network load due to mass (automatic) onboarding
> appears to be a non-issue.
>
>
>
> Second, I had a hard time finding performance data for the proposals.
> Getting an understanding of the required code size & ram size on embedded
> devices would also be super useful.
>
>
>
> Third, it remains to be seen whether new PAKEs will get adopted by SDOs
> working on IoT for two reasons: (1) There is a push from governments not to
> use passwords on IoT devices (irrespectively of whether they are using
> PAKEs or not; a distinction that is not understood by users anyway.) (2)
> There are two PAKEs deployed already, namely JPAKE (in Thread) and
> Dragonfly (for use with WiFi security). At least in Thread, the effort
> wasn’t very successful because we have other technologies that give us
> better properties without bothering the user.
>
>
>
> Ignoring the third item, I was wondering whether someone can help me with
> my analysis by pointing to performance data or code (ideally from those
> working on the proposals).
>
>
>
> Ciao
>
> Hannes
> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>
-- 

С уважением,

Станислав Смышляев, к.ф.-м.н.,

Заместитель генерального директора

ООО «КРИПТО-ПРО»