Re: [kitten] AD review of draft-ietf-kitten-krb-spake-preauth-06

[Greg Hudson <[e-mail]>]

On 4/4/19 7:58 PM, Benjamin Kaduk wrote:
> In general this document is in good shape, but the elephant in the room
> is the state of the dependency draft-irtf-cfrg-spake2, which is
> apparently not as stable as we thought.  It seems likely that we'll need
> to wait until that document is further along before we can finalize our
> revisions to this document and go to IETF LC; furthermore, I expect
> we'll want to reissue some codepoints so that the current meanings stay
> valid (tied to draft-irtf-cfrg-06's behavior) and the new codepoints
> match the RFC version of the CFRG spec.  (Except when we consciously
> diverge, as for the transcript hash, etc.)
> 
> In particular I think we will need to allocate a new PA-SPAKE value.
> (I don't think I see a reason to allocate a new KEY_USAGE_SPAKE value.)

I guess we didn't have the same takeaways regarding the recent revisions
to draft-irtf-cfrg-spake2.  I argued that the changes to cofactor
handling in SPAKE2 were unnecessary, inconsistent with how X25519 was
specified, and should be reverted (though w1 in SPAKE2+ should become a
scaled cofactor instead of an unscaled one).

There are also changes to the requirements for key derivation which I
believe we cannot reasonably meet within the Kerberos protocol; while
these changes can be reasonably justified, I believe they make
draft-irtf-cfrg-spake2 unsuitable as a normative reference for
draft-ietf-kitten-krb-spake-preauth in my opinion.  Instead, we should
describe the SPAKE2 algorithm within the Kerberos draft as it is used
there, using the Abdalla/Pointcheval paper as an informative reference.

I do not at this time understand why we would want or need to allocate
new code points.