Re: [CFRG] Attack on a Real World SPAKE2 Implementation

[Filippo Valsorda <[e-mail]>]

2021-05-08 21:25 GMT+02:00 Watson Ladd <[e-mail] <mailto:watsonbladd%40gmail.com>>:
> On Fri, May 7, 2021, 7:52 PM Filippo Valsorda <[e-mail]> wrote:__
>> 2021-05-07 04:17 GMT-04:00 Peter Gutmann <[e-mail] <mailto:pgut001%40cs.auckland.ac.nz>>:
>>> Ruben Gonzalez <[e-mail] <mailto:in%2Blists%40ruben-gonzalez.de>> writes:
>>> 
>>> >We did not attack SPAKE2 directly, but a faulty implementation.
>>> 
>>> Nice work!  This is an example of what I once referred to as second-order
>>> snake oil crypto, good crypto applied badly (first-order is bad crypto).
>> 
>> Snake oil is fraudulent. This is a broken implementation, for which specification authors should at least consider sharing the blame. How did the spec fail the implementers, who presumably were not trying to implement something in a broken way?
> 
> The SPAKE2 draft postdates many if the deployed implementations. There is no evidence the authors consulted the draft which counting specified M and N to avoid exactly this failure.
>> 
>> 
>> (I know, I know, SPAKE2 is a draft, not an RFC! But it's been a draft for almost 7 years, and at some point people need to implement stuff.)
> 
> I think the failure to publish a secure protocol that is actually deployed and used in a timely manner is a problem. Thankfully it has at last gotten out of the CFRG.
> 
> Part of the issue is that I had a dissertation to write and was not the most motivated all of the time. But the bigger issue imho is that very few implementors gave feedback or provided the prodding to advance it. Until Ben came along no one cared and kitten ended up doing its own thing because we were too slow.
> 
> What happened to rough consensus and running code?

That was bad phrasing on my side, sorry Watson.

It was "specification authors" at large, not "this specification's Authors". It looks like the way it failed this implementation might be by not finalizing soon enough, which is definitely not your individual responsibility (as that would be of course an unsustainable model).

In other words, agreed on where the problem lies.