Re: [Crypto-panel] Answers to PAKE Questions

Many thanks, Watson!

пн, 10 февр. 2020 г. в 19:03, Watson Ladd <watsonbladd@gmail.com>:

> This time with correct email
>
>
> On Sun, Feb 9, 2020 at 9:43 PM Watson Ladd <watsonbladd@gmail.com> wrote:
> >
> > Question 1: (to SPAKE2): Can you propose a modification of SPAKE2
> > (preserving all
> >
> > existing good properties of PAKE2) with a correspondingly updated
> security
> >
> > proof, addressing the issue of a single discrete log relationship
> necessary
> >
> > for the security of all sessions (e.g., solution based on using
> >
> > M=hash2curve(A|B), N=hash2curve(B|A))?
> >
> >
> > The next version will include an option to have M and N based on party
> > identities, ensuring that an attacker with the ability to solve a
> > discrete logarithm problem can only compromise a single session per
> > discrete logarithm computed. This form does introduce a dependency on
> > the hash2curve draft, and requires an invocation of hash2curve per
> > pair of participants. The proof of such a construction is in
> > https://eprint.iacr.org/2019/1194.
> >
> >
> > Question 2:Can the nominators/developers of the
> >
> > protocols please re-evaluate possible IPR conflicts between their
> >
> > candidates protocols and own and foreign patents? Specifically, can you
> >
> > discuss the impact of U.S. Patent 7,047,408 (expected expiration 10th of
> >
> > march 2023) on free use of SPAKE2 and the impact of EP1847062B1 (HMQV,
> >
> > expected expiration October 2026) on the free use of the RFC-drafts for
> >
> > OPAQUE?
> >
> >
> > I’m not a patent lawyer, and cannot speculate on any IPR conflicts
> > that may or may not exist.
> >
> >
> > Question 4:What can be said about the property of
> >
> > "quantum annoyance" (an attacker with a quantum computer needs to solve
> >
> > [one or more] DLP per password guess) of the PAKE?
> >
> >
> > An adversary needs to solve a single DLP and then carry out an online
> > attack to recover the password without further quantum work.
> >
> >
> > Question 5: What can be said about "post-quantum preparedness" of the
> PAKE?
> >
> > SPAKE2 is unlikely to have a post-quantum alternative.
>
>
>
> --
> "Man is born free, but everywhere he is in chains".
> --Rousseau.
>
> _______________________________________________
> Crypto-panel mailing list
> Crypto-panel@irtf.org
> https://www.irtf.org/mailman/listinfo/crypto-panel
>