Re: [Cfrg] RFC 7664 on Dragonfly Key Exchange

On Wed, November 11, 2015 7:12 pm, Tony Arcieri wrote:
> On Wed, Nov 11, 2015 at 5:18 PM, Watson Ladd <watsonbladd@gmail.com>
> wrote:
>
>> Dear all,
>> This protocol does not match the one whose security was proven. The
>> modification is cheap: include identities in the Confirmation
>> Exchange. It's specifically suggested in the text. Why was this not
>> done?

  I wanted to do that but was told not to by one of the chairmen
because that was not the exchange that was reviewed by the group.

> I second this and also I find the "Security Considerations" section of
> this
> draft incredibly misleading. Specifically it claims:
>
>
> This key exchange protocol has received cryptanalysis in [clarkehao].
> [lanskro] provides a security proof of Dragonfly in the random oracle
> model
> when both identities are included in the data sent in the Confirm Exchange
> (see Section 3.4).
>
>
> This is, at best, a rather "rose colored glasses" interpretation of the
> actual [clarkehao] paper:

  It is nothing of the sort. That comment refers to the -00
version of the draft which was rushed to get out before an I-D
cut-off date-- to see how rushed, note the "Acknowledgements"
section of the draft is the xml2rfc boilerplate. In my haste
I failed to include a check to validate received elements (note
that EAP-pwd which uses the exchange and was published before
the draft was written includes element validation so it was
part of the exchange, just not included in the -00 version).

> https://eprint.iacr.org/2013/058.pdf
>
> In this paper, we examine the security properties of the Dragonfly
> protocol. Contrary to the authorâs claims, we show that both variants
> are
> subject to an off-line dictionary attack. In this paper, we will base our
> analysis upon the original protocol specification as defined in a
> peer-reviewed paper [1]. However, the attack we will present is trivially
> applicable to the variant specified in [2]. (According to the Dragonfly
> author, the current Internet draft, which expires on April 15, 2013 [2],
> will be changed soon in light of our reported attack.)
>
>
> I would suggest the protocol be updated as Watson suggests, and that the
> wording in "Security Considerations" be modified to clarify the attacks
> discovered in the cited [clarkehao] paper and how they have (not yet, but
> should be per [lanskro]) been remediated.

  I would kindly suggest you read the RFC and then read the
full paper because it is plainly obvious that you didn't get
past the introduction.

  regards,

  Dan.

> --
> Tony Arcieri
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>