[Cfrg] [CFRG] PAKE: Draft for AuCPace available // Feedback appreciated regarding legacy-database migration to PAKE for servers
Björn Haase <bjoern.haase@endress.com> Mon, 13 January 2020 10:54 UTC
Return-Path: <bjoern.haase@endress.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4118B1200D8 for <cfrg@ietfa.amsl.com>; Mon, 13 Jan 2020 02:54:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=endress.com header.b=duVR9BTB; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=endress.com header.b=Oe1WQ9uc
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZHGvqcD2_n1t for <cfrg@ietfa.amsl.com>; Mon, 13 Jan 2020 02:54:27 -0800 (PST)
Received: from EUR05-VI1-obe.outbound.protection.outlook.com (mail-vi1eur05on2059.outbound.protection.outlook.com [40.107.21.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7CD71200CD for <cfrg@irtf.org>; Mon, 13 Jan 2020 02:54:26 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=endress.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MwpOWPS1SePwb7DX9+LATZgWgLtLCd5ZdWqZ7NsjQho=; b=duVR9BTBwt8abF5apq8N+jBZOQemDdo77R4VkU9LB+54FwhwUnA03QVYHL/YHVqZdVlCCoP6Uw5InEeZm6IbMOShlyRUio8l06M05xPAEyGp1gbClbRPIM6kaWfs1tGjWWVvpRRIZhq0qxI/0xxQkVudHMV9h86ArjvbC2r7/2M=
Received: from HE1PR05CA0210.eurprd05.prod.outlook.com (2603:10a6:3:f9::34) by DB7PR05MB5370.eurprd05.prod.outlook.com (2603:10a6:10:69::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2623.13; Mon, 13 Jan 2020 10:54:23 +0000
Received: from DB5EUR03FT048.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e0a::202) by HE1PR05CA0210.outlook.office365.com (2603:10a6:3:f9::34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2623.10 via Frontend Transport; Mon, 13 Jan 2020 10:54:23 +0000
Authentication-Results: spf=pass (sender IP is 40.68.44.165) smtp.mailfrom=endress.com; irtf.org; dkim=fail (body hash did not verify) header.d=endress.com;irtf.org; dmarc=pass action=none header.from=endress.com;
Received-SPF: Pass (protection.outlook.com: domain of endress.com designates 40.68.44.165 as permitted sender) receiver=protection.outlook.com; client-ip=40.68.44.165; helo=iqsuite.endress.com;
Received: from iqsuite.endress.com (40.68.44.165) by DB5EUR03FT048.mail.protection.outlook.com (10.152.21.28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2602.11 via Frontend Transport; Mon, 13 Jan 2020 10:54:22 +0000
Received: from mail pickup service by iqsuite.endress.com with Microsoft SMTPSVC; Mon, 13 Jan 2020 11:54:22 +0100
Received: from EUR04-VI1-obe.outbound.protection.outlook.com ([104.47.14.50]) by iqsuite.endress.com over TLS secured channel with Microsoft SMTPSVC(8.5.9600.16384); Mon, 13 Jan 2020 11:54:21 +0100
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=YbXhVGl1jq4APq7s6MRivRn26eRKqxwSguSBmqCkRnJOwGAW9Ju++54Z8cusbF+7oWfDF7owQT1E7I+xxqOUVP3LYXm3wcJ7utDGJMgRxrEhRPvf04kYKSCYlDf67CNoXUtOXYnbMFHVVELVhbBudwlQiClfoPq7ndnLkdrLKYRxnkF+Z9hWUb2fvNNxI5Gc7ptEk9twm695awnpKq5syXuGrVcmw9Tr7EV6oonKGS2+GLQSVQyQUf+sWYRPNBv57ghPgIcfiBQtZ5sOwDVqItXXnXkE/06URX8mxUZ+6eJamSCnIa2a1NF2pozAaLuibhBp3sdCdo23TATMJYC/yg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cBSJOawJSeqQFtY1L2RGPJfW/XJLHPbzunpuL2LutSE=; b=WDpneD2Pjr0NEtCVL7VfWKK+o+X5C6dVpFiRe272NIka0yx/lj7BKNdB3cGtR5zbkQvCIDzyKEz2pvgEqXrxq/+EuU9dOVy4z0mfbJV3rMVZWVe5M6SqpCoBGWJaCOnzTfWPyYDQXFDwV/s2cLFOS2i4BgODS8VS/IPCYDXmeVTbt7vdopZLDxCdWQxTFCdcmjp3/KJo/45P4ubXYKPIRcu6l4/6gmZDDtQJU8vFeB7R54HtAEx5zbt8xERsQSLEo9djrtJYEOXjB0i4EqXRxPNFMAf40xbEzLTZkEMPH0C5+VbX6EeUo2qRwzqR/cz5BgdZd2c/V3OyRP5zN+LhqQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=endress.com; dmarc=pass action=none header.from=endress.com; dkim=pass header.d=endress.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=endress.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cBSJOawJSeqQFtY1L2RGPJfW/XJLHPbzunpuL2LutSE=; b=Oe1WQ9ucRnqvJgk0ov2q8rCaGCM/iOPEV2nDct9WaEZUQy54NM38vFhMECv9uJcNJDWPeVfDzB+pm0YP0KaMw+orTcklUUhSTQdZuXyj+lL1XpacU5/5QDi/0A6llW7pTUCcuboqaTE5cGCD3z9mkZ10olYPpRmP/4xYODgX+yU=
Received: from VI1PR05MB6509.eurprd05.prod.outlook.com (20.179.25.86) by VI1PR05MB3245.eurprd05.prod.outlook.com (10.170.239.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2623.9; Mon, 13 Jan 2020 10:54:20 +0000
Received: from VI1PR05MB6509.eurprd05.prod.outlook.com ([fe80::c86b:8318:bcac:cd1b]) by VI1PR05MB6509.eurprd05.prod.outlook.com ([fe80::c86b:8318:bcac:cd1b%4]) with mapi id 15.20.2623.015; Mon, 13 Jan 2020 10:54:20 +0000
From: Björn Haase <bjoern.haase@endress.com>
To: "cfrgirtf.org" <cfrg@irtf.org>
Thread-Topic: [CFRG] PAKE: Draft for AuCPace available // Feedback appreciated regarding legacy-database migration to PAKE for servers
Thread-Index: AdXJ/6RJ7EiFK38YT2avoTmwl54QlQ==
Content-Class:
Date: Mon, 13 Jan 2020 10:54:20 +0000
Message-ID: <VI1PR05MB65095AC60E6DCA1B42284C8E83350@VI1PR05MB6509.eurprd05.prod.outlook.com>
Accept-Language: de-DE, en-US
Content-Language: de-DE
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_2988f0a4-524a-45f2-829d-417725fa4957_Enabled=True; MSIP_Label_2988f0a4-524a-45f2-829d-417725fa4957_SiteId=52daf2a9-3b73-4da4-ac6a-3f81adc92b7e; MSIP_Label_2988f0a4-524a-45f2-829d-417725fa4957_Owner=bjoern.haase@endress.com; MSIP_Label_2988f0a4-524a-45f2-829d-417725fa4957_SetDate=2020-01-13T10:54:18.7040514Z; MSIP_Label_2988f0a4-524a-45f2-829d-417725fa4957_Name=Not Protected; MSIP_Label_2988f0a4-524a-45f2-829d-417725fa4957_Application=Microsoft Azure Information Protection; MSIP_Label_2988f0a4-524a-45f2-829d-417725fa4957_ActionId=1982f90d-c5ba-40d3-9107-8be625fe4589; MSIP_Label_2988f0a4-524a-45f2-829d-417725fa4957_Extended_MSFT_Method=Automatic
Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=bjoern.haase@endress.com;
x-originating-ip: [93.240.145.106]
x-ms-publictraffictype: Email
X-MS-Office365-Filtering-Correlation-Id: 579cf10d-cc59-4206-c043-08d79816f2c4
X-MS-TrafficTypeDiagnostic: VI1PR05MB3245:|DB7PR05MB5370:
X-Microsoft-Antispam-PRVS: <DB7PR05MB537067C1D0C4F7BFE35F0C0C83350@DB7PR05MB5370.eurprd05.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:9508;OLM:9508;
x-forefront-prvs: 028166BF91
X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009020)(4636009)(376002)(346002)(366004)(396003)(39860400002)(136003)(189003)(199004)(64756008)(66946007)(66556008)(66476007)(8936002)(66446008)(2906002)(6916009)(86362001)(81166006)(81156014)(316002)(76116006)(85182001)(8676002)(66574012)(5660300002)(966005)(478600001)(33656002)(71200400001)(52536014)(6506007)(55016002)(26005)(85202003)(186003)(19627235002)(9686003)(7696005)(130980200001); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR05MB3245; H:VI1PR05MB6509.eurprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: endress.com does not designate permitted sender hosts)
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: xJGg7dBm2Ylexlct+k+nHEhKYzDDBtC6QGPFkmGIZEds2VAdMg/GnggKLwMRcRZmB62Vd5jeDMU6RZ3DA9/+3fBv8vULp3d5s8Nk1fNDLEr62kphQA1bwugxr6liAoa7Ifh1k+8t3gTi5nq8qODX/n+tCFneJhrQxPYnMIveSDC8HcB/8puvlnAWBK8hjX8L42GrDjfMhZ0TLPbA5Kden7KeLRli+Q7JcpsKdiHO4akEbi5GdWjJsWahbjwmNe7jZ9dl9WJ90Yl2q8K4bZAemlFmSV/0qpBY7UdMMhJLSZgEmU/qflQj/10EqM4cJ5mUDRTZieuMmBQR0kHKHAd/gKh3gbBeSHYAOvO90ND/2vX1SwQAfOgIXODRrT0mjily1lZai2n51NRKyRdYv/9XZ3QH0TeXqS0eyIG5IE8vPxvVV0LYXEmD4c9l/Kcuy75/3ZcE6COHyr+Q2fnaXzne5ieiCDwVLLIEmCT3nHO01cj819KBNKtQszvqoRpjbzE9eRrkDSGW6bCdzdNcytie7N4Keq0/2ydIRtiKxM/YnNX9C973TqT7lVv/BpIcUwZLtTjHcCcSALnF7DC/nvIOOg==
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_VI1PR05MB65095AC60E6DCA1B42284C8E83350VI1PR05MB6509eurp_"
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR05MB3245
X-OriginalArrivalTime: 13 Jan 2020 10:54:21.0526 (UTC) FILETIME=[CFAB6F60:01D5C9FF]
X-Trailer: 1
X-GBS-PROC: xgFUxKjHYlIgAVhEyCM0Kn4pGgMQBqNy0Xn/JA0RN6k=
X-GRP-TAN: IQWE01@0EB93D165B1344E48AC2CFD522CAF26F
X-iqsuite-process: processed
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: DB5EUR03FT048.eop-EUR03.prod.protection.outlook.com
X-Forefront-Antispam-Report: CIP:40.68.44.165; IPV:; CTRY:NL; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(396003)(376002)(39860400002)(346002)(136003)(199004)(189003)(33964004)(2906002)(6916009)(86362001)(26005)(186003)(356004)(7696005)(33656002)(6506007)(66574012)(85182001)(19627235002)(15974865002)(478600001)(966005)(5660300002)(8676002)(81166006)(81156014)(316002)(8936002)(336012)(55016002)(9686003)(52536014)(85202003)(70586007)(70206006)(130980200001); DIR:OUT; SFP:1101; SCL:1; SRVR:DB7PR05MB5370; H:iqsuite.endress.com; FPR:; SPF:Pass; LANG:en; PTR:InfoDomainNonexistent; A:1; MX:1;
X-MS-Office365-Filtering-Correlation-Id-Prvs: 71afc49e-e4a8-41b4-cf1b-08d79816f156
X-Forefront-PRVS: 028166BF91
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: M6FuvMn69O2pJthJq3FyicX6xxxwQJNLahfbR6WFbAEIbZtODNAnEtXHmKRXBggHnJ3AMjFhROcU/BXdt91I6NOImajEvyZFQ8whrQ5HBreq/iR3IS+spMG8hzwhn+9b3z034TDwMVI3wjjjprt5M9q2j8Q2cgPoiLKnUDfnURsBiwzNTGufLgcZKJukobmueH59mNfYPIrj9EIORAZdH+XK22i5Nwfy7RezkmjlZyDkPPHu0+fPtS6FtCT1s72qJqTGlS5r7DP1Spi1ziji75LDHsPkXwkY4UGP/2OJ9X37I5/+YJRDOEn2aKIYNB87ZnTJ4ZsLiPs7lc8TrP9HQDxH3Xl7tCxLMqHMSh53HXyjnsfBHSI0spGBxhDWAMTZoJXaH6Nbe6BWcdcRQvytVCyPIcBpKxzBV8Ema41hLdEqovE9APAzWuiUzXrYgba3z/WFSTcLd7MOpUrjNZTZ43idOwPeU++w+bpxa8IQWf54XN/tlfqZa06mQV3Fo9jRdeGGzEF8h5nZC8cxflWJ4gAqPb6OczhNJ0HZYfStW2s=
X-OriginatorOrg: endress.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jan 2020 10:54:22.5387 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 579cf10d-cc59-4206-c043-08d79816f2c4
X-MS-Exchange-CrossTenant-Id: 52daf2a9-3b73-4da4-ac6a-3f81adc92b7e
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=52daf2a9-3b73-4da4-ac6a-3f81adc92b7e; Ip=[40.68.44.165]; Helo=[iqsuite.endress.com]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR05MB5370
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/ylYA3MWV_wpMiwJedFp7f6meX0w>
Subject: [Cfrg] [CFRG] PAKE: Draft for AuCPace available // Feedback appreciated regarding legacy-database migration to PAKE for servers
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Jan 2020 10:54:30 -0000
Dear CFRG community, I have just posted a first version of an RFC-style draft also regarding the augmented protocol AuCPace. Augmented: https://datatracker.ietf.org/doc/draft-haase-aucpace/ Balanced: https://datatracker.ietf.org/doc/draft-haase-cpace/ Any feedback would be appreciated! The draft as it is written now is meant to serve mainly as basis for a in depth security analysis. Specifically, I have also included the complexity of the user-credential database interface that was not detailed in the AuCPace paper. Specifically, I have pointed out, why “strong” pake protocols won’t allow for such a migration. Correspondingly the specification in the draft supports both, strong and conventional PAKE. I believe that for applications that today work with established large user-credential databases, a smooth migration to a PAKE-Approach might be highly relevant, e.g. for applications with a large existing customer base, such as e.g. Facebook. I think that this aspect might worth being discussed in more detail: Is migration of a legacy-style user-credential database on a server to a PAKE-suitable format an important use-case or not. Yours, Björn. Mit freundlichen Grüßen I Best Regards Dr. Björn Haase Senior Expert Electronics | TGREH Electronics Hardware Endress+Hauser Conducta GmbH+Co.KG | Dieselstrasse 24 | 70839 Gerlingen | Germany Phone: +49 7156 209 377 | Fax: +49 7156 209 221 bjoern.haase@endress.com | www.conducta.endress.com Endress+Hauser Conducta GmbH+Co.KG Amtsgericht Stuttgart HRA 201908 Sitz der Gesellschaft: Gerlingen Persönlich haftende Gesellschafterin: Endress+Hauser Conducta Verwaltungsgesellschaft mbH Sitz der Gesellschaft: Gerlingen Amtsgericht Stuttgart HRA 201929 Geschäftsführer: Dr. Manfred Jagiella Gemäss Datenschutzgrundverordnung sind wir verpflichtet, Sie zu informieren, wenn wir personenbezogene Daten von Ihnen erheben. Dieser Informationspflicht kommen wir mit folgendem Datenschutzhinweis (https://www.endress.com/de/cookies-endress+hauser-website) nach. Disclaimer: The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you receive this in error, please contact the sender and delete the material from any computer. This e-mail does not constitute a contract offer, a contract amendment, or an acceptance of a contract offer unless explicitly and conspicuously designated or stated as such.