Re: [Cfrg] OPAQUE at Facebook

What about balloon hashing? It's compactness is very attractive. 

David

> On Aug 27, 2019, at 8:18 PM, Björn Haase <bjoern.haase@endress.com> wrote:
> 
> Hi to all,
>  
> as one of the ones who nominated a candidate for augmented PAKE (AuCPace) I can confirm that the CFRG reviewers are presently very active and reviewing e.g. the proof strategies in detail. I agree that memory-hard password hashing should be used (in my proposal, I have suggested scrypt, but Argon2 is also a decent choice).
>  
> I also agree that we should really have a standardized protocol that mandates use of strong password hashes also for applications such as social media.
>  
> Yours,
>  
> Björn.
>  
> Von: Cfrg <cfrg-bounces@irtf.org> Im Auftrag von Bill Cox
> Gesendet: Mittwoch, 28. August 2019 02:47
> An: Kevin Lewi <klewi@cs.stanford.edu>
> Cc: IRTF CFRG <cfrg@irtf.org>
> Betreff: Re: [Cfrg] OPAQUE at Facebook
>  
> It would be great to hear from this group on where the community
> stands with the standardization of augmented PAKEs.
> 
> - Kevin
> 
>  
> I, for one, would say great minds think alike :)  The OPAQUE RFC could use some tweeks, but looks pretty strong, IMO.  For example  they're recommendation of iterating a password hash should be replaced with calling Argon2.  Note that Argon2 runs pretty fast in browsers that support web assembly.  Password hashing has to be done client-side in OPAQUE, with the possible exception of using Makwa delegated hashing possibly in paraallel with the OPRF round-trip.
> 
> Mit freundlichen Grüßen I Best Regards
> 
> Dr. Björn Haase
> 
> Senior Expert Electronics | TGREH Electronics Hardware
> Endress+Hauser Conducta GmbH+Co.KG | Dieselstrasse 24 | 70839 Gerlingen | Germany
> Phone: +49 7156 209 377 | Fax: +49 7156 209 221
> bjoern.haase@endress.com | www.conducta.endress.com 
> 
> Endress+Hauser Conducta GmbH+Co.KG
> Amtsgericht Stuttgart HRA 201908
> Sitz der Gesellschaft: Gerlingen
> Persönlich haftende Gesellschafterin:
> Endress+Hauser Conducta
> Verwaltungsgesellschaft mbH
> Sitz der Gesellschaft: Gerlingen
> Amtsgericht Stuttgart HRA 201929
> Geschäftsführer: Dr. Manfred Jagiella
> 
> Gemäss Datenschutzgrundverordnung sind wir verpflichtet, Sie zu informieren, wenn wir personenbezogene Daten von Ihnen erheben.
> 
> Dieser Informationspflicht kommen wir mit folgendem Datenschutzhinweis nach.
> 
>  
> 
> Disclaimer:
> 
> The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged
> material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities
> other than the intended recipient is prohibited. If you receive this in error, please contact the sender and delete the material from any computer.
> This e-mail does not constitute a contract offer, a contract amendment, or an acceptance of a contract offer unless explicitly and conspicuously designated or stated as such.
> 
>  
> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg