Re: [Cfrg] RFC 7664 on Dragonfly Key Exchange

[Tony Arcieri <[e-mail]>]

On Wed, Nov 11, 2015 at 5:18 PM, Watson Ladd <[e-mail]> wrote:

> Dear all,
> This protocol does not match the one whose security was proven. The
> modification is cheap: include identities in the Confirmation
> Exchange. It's specifically suggested in the text. Why was this not
> done?


I second this and also I find the "Security Considerations" section of this
draft incredibly misleading. Specifically it claims:


This key exchange protocol has received cryptanalysis in [clarkehao].
[lanskro] provides a security proof of Dragonfly in the random oracle model
when both identities are included in the data sent in the Confirm Exchange
(see Section 3.4).


This is, at best, a rather "rose colored glasses" interpretation of the
actual [clarkehao] paper:

https://eprint.iacr.org/2013/058.pdf

In this paper, we examine the security properties of the Dragonfly
protocol. Contrary to the author’s claims, we show that both variants are
subject to an off-line dictionary attack. In this paper, we will base our
analysis upon the original protocol specification as defined in a
peer-reviewed paper [1]. However, the attack we will present is trivially
applicable to the variant specified in [2]. (According to the Dragonfly
author, the current Internet draft, which expires on April 15, 2013 [2],
will be changed soon in light of our reported attack.)


I would suggest the protocol be updated as Watson suggests, and that the
wording in "Security Considerations" be modified to clarify the attacks
discovered in the cited [clarkehao] paper and how they have (not yet, but
should be per [lanskro]) been remediated.

-- 
Tony Arcieri