Re: [Crypto-panel] Answers to PAKE Questions

[Watson Ladd <[e-mail]>]

This time with correct email


On Sun, Feb 9, 2020 at 9:43 PM Watson Ladd <[e-mail]> wrote:
>
> Question 1: (to SPAKE2): Can you propose a modification of SPAKE2
> (preserving all
>
> existing good properties of PAKE2) with a correspondingly updated security
>
> proof, addressing the issue of a single discrete log relationship necessary
>
> for the security of all sessions (e.g., solution based on using
>
> M=hash2curve(A|B), N=hash2curve(B|A))?
>
>
> The next version will include an option to have M and N based on party
> identities, ensuring that an attacker with the ability to solve a
> discrete logarithm problem can only compromise a single session per
> discrete logarithm computed. This form does introduce a dependency on
> the hash2curve draft, and requires an invocation of hash2curve per
> pair of participants. The proof of such a construction is in
> https://eprint.iacr.org/2019/1194.
>
>
> Question 2:Can the nominators/developers of the
>
> protocols please re-evaluate possible IPR conflicts between their
>
> candidates protocols and own and foreign patents? Specifically, can you
>
> discuss the impact of U.S. Patent 7,047,408 (expected expiration 10th of
>
> march 2023) on free use of SPAKE2 and the impact of EP1847062B1 (HMQV,
>
> expected expiration October 2026) on the free use of the RFC-drafts for
>
> OPAQUE?
>
>
> I’m not a patent lawyer, and cannot speculate on any IPR conflicts
> that may or may not exist.
>
>
> Question 4:What can be said about the property of
>
> "quantum annoyance" (an attacker with a quantum computer needs to solve
>
> [one or more] DLP per password guess) of the PAKE?
>
>
> An adversary needs to solve a single DLP and then carry out an online
> attack to recover the password without further quantum work.
>
>
> Question 5: What can be said about "post-quantum preparedness" of the PAKE?
>
> SPAKE2 is unlikely to have a post-quantum alternative.



-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.