Re: [Crypto-panel] [Cfrg] PAKE Selection Process: Round 2, Stage 2

Dear Watson,

Thanks, but we're still collecting the questions, the authors (including
you for SPAKE2) will have time at Stage 3 (December 25th - February, 10th)
to prepare the replies (Stage 3: "The authors of the candidates prepare
their replies to the additional questions/requested clarifications.").

пн, 9 дек. 2019 г. в 18:41, Watson Ladd <watsonbladd@gmail.com>:

>
>
> On Mon, Dec 9, 2019 at 4:44 AM Stanislav V. Smyshlyaev <smyshsv@gmail.com>
> wrote:
>
>> Dear CFRG,
>>
>> According to the plan of Round 2 of the PAKE selection process,
>> additional questions for all four remaining candidates have been collected
>> from CFRG participants (and Crypto Review Panel members) via
>> crypto-panel@irtf.org .
>>
>> We've obtained the following list of questions:
>> 1) (to SPAKE2): Can you propose a modification of SPAKE2 (preserving all
>> existing good properties of PAKE2) with a correspondingly updated security
>> proof, addressing the issue of a single discrete log relationship necessary
>> for the security of all sessions (e.g., solution based on using
>> M=hash2curve(A|B), N=hash2curve(B|A))?
>>
>
> Yes: See https://github.com/kaduk/spake2/pull/10 and for the security
> proof,  https://eprint.iacr.org/2019/1194. I'll submit it shortly, but
> this should indicate where we are going.
>
> 2) (to CPace and AuCPace): Can you propose a modification of CPace and
>> AuCPace (preserving all existing good properties of these PAKEs) with a
>> correspondingly updated security proof (maybe, in some other security
>> models), addressing the issue of requiring the establishment of a session
>> identifier (sid) during each call of the protocol for the cost of one
>> additional message?
>> 3) (to all 4 remaining PAKEs) : Can the nominators/developers of the
>> protocols please re-evaluate possible IPR conflicts between their
>> candidates protocols and own and foreign patents? Specifically, can you
>> discuss the impact of U.S. Patent 7,047,408 (expected expiration 10th of
>> march 2023) on free use of SPAKE2 and the impact of EP1847062B1 (HMQV,
>> expected expiration October 2026) on the free use of the RFC-drafts for
>> OPAQUE?
>>
>
> I'm not a patent lawyer, or any kind of lawyer. This sounds like a
> question for a patent lawyer, rather then uninformed speculation on the
> list.
>
> 4) (to all 4 remaining PAKEs) What can be said about the property of
>> "quantum annoyance" (an attacker with a quantum computer needs to solve
>> [one or more] DLP per password guess) of the PAKE?
>>
>
> I'll have to look at the papers some more. Will answer in a few days.
>
> 5) (to all 4 remaining PAKEs) What can be said about "post-quantum
>> preparedness" of the PAKE?
>>
>
> There isn't a great answer here for SPAKE2 AKAIK. Postquantum primitives
> don't smoothly translate point addition or group laws.
>
>
>> Please let the chairs and the Crypto Review Panel members know (before
>> December, 17th) if any questions (collected via  crypto-panel@irtf.org)
>> have been lost or misinterpreted (or something needs to be added).
>>
>> Best regards,
>> Stanislav,
>> CFRG Secretary
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> https://www.irtf.org/mailman/listinfo/cfrg
>>
>