Re: [Cfrg] The SESPAKE protocol and PAKE requirements

["Stanislav V. Smyshlyaev" <[e-mail]>]

Good afternoon,

Jörn, thank you for the updated version of the PAKE requirements RFC draft.

All my concerns were dealt with – in my opinion, the requirements draft is
complete now.

Best regards,

Stanislav Smyshlyaev


2016-04-27 11:11 GMT+03:00 Stanislav V. Smyshlyaev <[e-mail]>:

> Thank you for your response, Jörn, it will be a pleasure to continue our
> discussion after your modifications!
>
> Kindest regards,
>
> Stanislav.
>
>
> 2016-04-27 10:22 GMT+03:00 Schmidt, Jörn-Marc <
> [e-mail]>:
>
>> Hello Stanislav,
>>
>> You're right, the two points are not precise enough - my sentence was too
>> sloppy. I'll use your suggestion for the active adversary. I think it
>> covers also passive adversaries - if eavesdropping leads to any information
>> about the password, there is no "guess" needed. Which reminds me that
>> "guess" is again not the best term - I'll use something like "interaction
>> with legitimate parties"..
>>
>> Thanks a lot!
>>
>> Best regards,
>>
>> Jörn
>>
>> ----
>> >Two points must be corrected in the sentence (2):
>> >- not "divided by the password length", but "divided by the cardinality
>> of the set of possible passwords" (for example, if you use passwords of
>> digits 0-9 of length 8, the probability of success for 3 trials is
>> estimated not as 3/8, but as 3/(10^8)).
>> >- not "limited by [the number...divided...]", but something like
>> "limited by [the number...divided...] plus a negligible value" (it is
>> always a possibility with a negligible probability, that adversary breaks a
>> CDH instance etc).
>>
>>
>> >Moreover, since the requirement (1) in your statement can be trivially
>> achieved without any PAKE (if you just use simple DH without any passwords,
>> it's OK for the case of a passive adversary), I'd prefer to modify your
>> statement in this way:
>> >"In particular, the proof must show that the probability of an active
>> adversary to (1) pass authentication or (2) to learn anything about the
>> password or (3) to learn anything about the established key is limited by
>> the number of guesses divided by the ...."
>>
>>
>