Re: [Cfrg] Adoption call for draft-harkins-pkex-05

[Christopher Wood <[e-mail]>]

Hi Dan,

On Mon, Aug 6, 2018 at 10:58 AM Daniel Harkins <[e-mail]> wrote:
>  About "commodity tools", there were two complaints raised:
>
>   1. PKEX hashes the user identity with the password and uses the result
>      with the role-specific constant while SPAKE2 does not;
>   2. PKEX should just have a generic proof-of-possession protocol after the PAKE.
>
> The implication being you combine these two and voila, something better than PKEX
> because it's just using known tools to do this and is not rolling new crypto.
>
>   Regarding the first, it's a draft that will be a work item of the research
> group. If the consensus of the group is to edit the draft then the draft gets
> edited to reflect the consensus of the group.
>
>   Regarding the second, the suggestion was to do this:
>
>     A->B: SPAKE-Kex
>     B->A: SPAKE-Kex, SPAKE-Confirm, {ID_B, Pub_B, Eph_B}K_spake_B
>     A->B: SPAKE-Confirm, {ID_A, Pub_A, Eph_A}K_spake_A, MAC(K_DH_A,transcript}
>     B->A: MAC(K_DH_B, transcript)
>
> Now I'm pretty sure that is not a generic commodity tool for doing proof-of-possession
> so I'm not sure what complaint is. That proof-of-possession is more complicated than
> what PKEX does, has more moving parts in the form of new ephemeral keys, does not
> actually seem to prove possession of the private key, and I'd wager does not have a
> security proof (Eric's final complaint about PKEX).
>
>   The request is not to rubber stamp the imprimatur of the CFRG on a document,
> it is to adopt a document as a work item of the research group. With that in mind,
> I have updated PKEX to incorporate the first suggestion (don't hash the ID with the
> password). The current version is -06, it's in the repository. Please take a look and
> consider its adoption.

Putting aside the issue of whether or not this should be done with
existing tools, I do not think the RG should adopt this document in
the absence of security analysis and a corresponding proof. Have you
(or anyone else) started work on this missing piece?

Best,
Chris