[Cfrg] dragonfly, was: Re: Time to recharter CFRG as a working group? Was: Re: [secdir] ISE seeks help with some crypto drafts

[Dan Harkins <[e-mail]>]

On 3/10/19 4:20 PM, Tony Arcieri wrote:
> On Sun, Mar 10, 2019 at 3:46 PM StJohns, Michael 
> <[e-mail] <mailto:[e-mail]>> wrote:
>
>     In recent years, the CFRG has produced documents that are for lack
>     of a better phrase de facto standards.  The rate of document
>     production of the CFRG mimics more closely that of a WG than the
>     other extant RGs AFAICT.   As an RG the CFRG isn’t permitted to
>     publish standards track documents, nor is the IESG or the ISE
>     permitted or constrained to require a conflict review on the
>     documents the CFRG does produce.  [the latter comment is my
>     understanding of the rules of the research stream - it may be
>     flawed, but the purpose of RGs is supposed to be looking at
>     futures and that by definition shouldn’t be conflicting with the
>     nows].
>
>
> An interesting datapoint on this is Dragonfly key exchange, published 
> as RFC 7664, has now been incorporated into the Wifi Alliance's WPA3 
> standard:
>
> https://sarwiki.informatik.hu-berlin.de/WPA3_Dragonfly_Handshake
>
> I will preface the following statement by saying that my criticisms of 
> Dragonfly on the CFRG list at the time were misinformed and due to a 
> lack of understanding, and would now call it "okay" (and many of my 
> concerns were assuaged after it received a security proof)..

   Well thanks for that.

> However, I think it's fair to say that as a non-standards document, it 
> has something of a sordid history:
>
> https://arstechnica.com/information-technology/2013/12/critics-nsa-agent-co-chairing-key-crypto-standards-body-should-be-removed/
>

   That was an amazing piece of "journalism". The author got spun up by 
a troll army on twitter (which
was about as accurate and reasonable as twitter tends to be) and 
basically alleged I was an NSA stooge
without even contacting me before printing (which is also a failure of 
the editorial process at Ars). It
was extremely unprofessional and resulted in numerous angry emails being 
received from people
who had no idea what they were talking about but were furious with me 
nonetheless.

   One of the problems with discussing the history of dragonfly is that 
everyone seems to get it
basically backwards. The protocol that is now part of WPA3 is SAE and it 
was actually the first
dragonfly protocol. It entered the 802.11 standard through an amendment 
in 2008 or so. I then
took the PAKE to EMU and that became EAP-pwd (published in 2010),  I 
took it to IPsec and it
became one of the possible PAKE extensions to IKEv2, and then I took it 
to TLS and got TLS-pwd
adopted as a work item at IETF 82 in Nov 2011. There was discussion in 
TLS of a security proof
(which it didn't have) and so a request for the CFRG to look at it. And 
that's where everything stood
when CFRG got involved.

   The reason this became so "sordid" is because people think everything 
began with the CFRG and
that I presented this protocol, as "journalist" Dan Goodin alleged, as a 
kind of follow on to
Dual_EC_DRBG.

> I think if there were a WG chartered specifically with a 
> standards-track document for what the next generation key exchange to 
> be used for use cases similar to and including, but not limited to 
> WiFi were, my best guess is we could've done better than Dragonfly. 
> I'm not sure why the Wifi Alliance chose it specifically, but it seems 
> the CFRG was treated at least in part as a bar the algorithm must pass 
> for incorporation into their standards, and for a standard of such 
> importance I guess what I'm saying is I wish that bar were higher.

   Well, WiFi Alliance didn't really "choose" SAE, it certifies things 
in 802.11 and the only thing in
802.11 that does a PAKE is SAE. Why wasn't a different PAKE chosen in 
802.11? Basically patents,
which were a problem back in 2006-7 and earlier when I was advocating 
for it. Why didn't anyone
else try and propose a PAKE to solve the dictionary attack problem 
against WPA-PSK? Good question.
That problem was known since around 2003 and was widely publicized yet I 
was the only person
to try and fix it.

   Bottom line, though, is the WiFi Alliance did not use the CFRG as a 
bar. The only group that was
using CFRG as a bar that the algorithm had to pass was TLS and TLS-pwd 
was parked and then
withdrawn from the TLS WG so for what it's worth the hullabaloo over 
dragonfly in CFRG-- right
or wrong-- served its purpose.

   regards,

   Dan.