[Cfrg] 2^40. I can't exhibit it, but it exists. -> Re: I-D Action: draft-irtf-cfrg-dragonfly-03.txt

[Paul Lambert <[e-mail]>]

> A proof might be desirable but should not block the use of a proposed protocol.
> For example there is no adequate proof that integer factorization is “secure”.
> This is not a reason to stop using RSA based algorithms.  The lack of
> a  complete security proof for draft-irtf-cfrg-dragonfly-03.txt should not
> stop it’s use (in fact it’s already in other standards that would benefit
> from the analysis and improvements of this group).

But there is a proof that OAEP has a reduction to RSA security. PKCS 1.5 had no proof, and got broken a few times. RSA has been intensively studied for decades, dragonfly hasn't. Slight variants of RSA (Rabin-Williams) are provably reducible to factoring, an extensively studied problem for centuries.

You missed the point.  The difficulty of factoring as a problem to build secure systems is not provable.
. . .


> Watson, in your technical analysis of the
> protocol in its current form (draft-irtf-cfrg-dragonfly-03.txt),
> can you identify any exploitable security flaw specific to
> the protocol?

Yes: an algorithm exists that guesses passwords in time 2^40. I can't exhibit it, but it exists. JPAKE doesn't have this issue.

I will take your answer as a ‘no’ - you are unable to identify any exploitable security flaw with draft-irtf-cfrg-dragonfly-03.txt

Making such repeated and  adversarial negative pronouncements on a technical topic without documentation or your own demonstrable analysis would be considered by some to be unprofessional behavior.


Paul