Re: [http-auth] I-D Action: draft-ietf-httpauth-mutual-algo-00.txt

Dear Rene,

this protocol is based on KAM3 of ISO/IEC 11770-4:2006.
ISO-spec says it is also called {DL, EC}APKAS-AMP in
IEEE P1363.2, proposed by T. Kwon.

There seems to be several literature written by the original
author.
http://www.isoc.org/isoc/conferences/ndss/01/papers/kwon.pdf
seems to be the most "academic" paper with analysis
to (some older revision of) this primitive, and there are also
several revisions submitted to P1363.
http://grouper.ieee.org/groups/1363/passwdPK/contributions/ampsummary.pdf
http://grouper.ieee.org/groups/1363/passwdPK/contributions/amp_final_revision.pdf
http://dasan.sejong.ac.kr/~tkwon/research/ampsummary2.pdf

I hope these will be helpful for reviewing and analyzing the proposal.

Using some other Augmented PAKE primitives with
my Mutual base proposal (draft-ietf-httpauth-mutual)
is easy in general.

2014-07-19 1:43 GMT+09:00 Rene Struik <rstruik.ext@gmail.com>:
> Dear authors:
>
> The algorithms in the draft seem to be based on the Augmented PAKE protocol,
> but differ in various aspects (e.g., hash function definition, details of
> cryptographic operation). Thus, it is not a priori clear whether the results
> in the AugPAKE paper apply here. If there is a technical write-up that
> analyzes the cryptographic properties of this (specific) protocol in detail
> that would be great.
>
> Best regards, Rene
>
>
> On 7/4/2014 6:02 PM, internet-drafts@ietf.org wrote:
>>
>> A New Internet-Draft is available from the on-line Internet-Drafts
>> directories.
>>   This draft is a work item of the Hypertext Transfer Protocol
>> Authentication Working Group of the IETF.
>>
>>          Title           : Mutual Authentication Protocol for HTTP:
>> KAM3-based Cryptographic Algorithms
>>          Authors         : Yutaka Oiwa
>>                            Hajime Watanabe
>>                            Hiromitsu Takagi
>>                            Kaoru Maeda
>>                            Tatsuya Hayashi
>>                            Yuichi Ioku
>>         Filename        : draft-ietf-httpauth-mutual-algo-00.txt
>>         Pages           : 15
>>         Date            : 2014-07-04
>>
>> Abstract:
>>     This document specifies some cryptographic algorithms which will be
>>     used for the Mutual user authentication method for the Hyper-text
>>     Transport Protocol (HTTP).
>>
>>
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-ietf-httpauth-mutual-algo/
>>
>> There's also a htmlized version available at:
>> http://tools.ietf.org/html/draft-ietf-httpauth-mutual-algo-00
>>
>>
>> Please note that it may take a couple of minutes from the time of
>> submission
>> until the htmlized version and diff are available at tools.ietf.org.
>>
>> Internet-Drafts are also available by anonymous FTP at:
>> ftp://ftp.ietf.org/internet-drafts/
>>
>> _______________________________________________
>> http-auth mailing list
>> http-auth@ietf.org
>> https://www.ietf.org/mailman/listinfo/http-auth
>
>
>
> --
> email: rstruik.ext@gmail.com | Skype: rstruik
> cell: +1 (647) 867-5658 | US: +1 (415) 690-7363
>
>
> _______________________________________________
> http-auth mailing list
> http-auth@ietf.org
> https://www.ietf.org/mailman/listinfo/http-auth

-- 
Yutaka OIWA, Ph.D.                 Leader, System Life-cycle Research Group
                               Research Institute for Secure Systems (RISEC)
     National Institute of Advanced Industrial Science and Technology (AIST)
                       Mail addresses: <y.oiwa@aist.go.jp>, <yutaka@oiwa.jp>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]