Re: [TLS] bootstrapping of constrained devices

"Paterson, Kenny" <Kenny.Paterson@rhul.ac.uk> Fri, 21 March 2014 17:55 UTC

Received-SPF: pass (mail118-co9: domain of rhul.ac.uk designates 157.56.248.5 as permitted sender) client-ip=157.56.248.5; envelope-from=Kenny.Paterson@rhul.ac.uk; helo=AMSPRD0310HT002.eurprd03.prod.outlook.com ; .outlook.com ;
From: "Paterson, Kenny" <Kenny.Paterson@rhul.ac.uk>
To: Feng Hao <feng.hao@newcastle.ac.uk>
Thread-Topic: [TLS] bootstrapping of constrained devices
Thread-Index: AQHPRRjdGRG2NbhO+U2QyRiSBBsmfJrrr/cAgAAEITCAAAsxAIAAE88d
Date: Fri, 21 Mar 2014 17:54:45 +0000
Message-ID: <3AD3276A-8CEB-448C-867F-2BF7962149DE@rhul.ac.uk>
References: <53288C43.9010205@mit.edu> <5328B6DF.8070703@fifthhorseman.net> <5328C0C8.9060403@mit.edu> <6b79e0820d349720f12b14d4706a8a5d.squirrel@webmail.dreamhost.com> <CALCETrUz8zCBHiq42GTnkkSaBcpA5pjSvk6kwwPjzn+MtBKMgA@mail.gmail.com> <e38419e3ada3233dbb3f860048703347.squirrel@webmail.dreamhost.com> <CALCETrVgJxfdCxZqc9ttHHNKHm-hdtGbqzHvsQ-6yd5BK=9PDw@mail.gmail.com> <67BAC033-2E23-4F03-A4D9-47875350E6B5@gmail.com> <532B0EAA.5040104@fifthhorseman.net> <8D8698DF-5C06-4F2A-8994-E0A36A987D6D@vpnc.org> <532B1739.80907@fifthhorseman.net> <CADrU+d+GkGU1Da3W6xGuOq4qvd40DdT6+sO6WEZeEag7Q1OiVQ@mail.gmail.com> <532B9B65.4030708@gmail.com> <8FD78E18-C3C7-4085-9E3F-8B60B20F2CB5@apple.com> <532C5867.2050704@gridmerge.com>, <CACsn0c=autfnANnTuszX+-EOgtSa6N7+S-hbEnj5ukyQPPUMVQ@mail.gmail.com> <D79ABD07-635D-4804-9934-2E426DE3A5B2@rhul.ac.uk>, <B15015334706B5489C2DCD6698A3D6CC552BD9AC@EXMBCT02.campus.ncl.ac.uk>
In-Reply-To: <B15015334706B5489C2DCD6698A3D6CC552BD9AC@EXMBCT02.campus.ncl.ac.uk>
Accept-Language: en-GB, en-US
Content-Language: en-GB
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/KYx-8fJKucw4RlLvlwXbx14ifD8
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] bootstrapping of constrained devices
Precedence: list

> On 21 Mar 2014, at 16:44, "Feng Hao" <feng.hao@newcastle.ac.uk> wrote:
> 
> Hi Kenny,
> 
>> As far as I am aware, there's no complete formal security analysis of J-PAKE.
>> There are claims in the original paper about the security conferred by the use
>> of ZK proofs, and some informal security analysis (stated as theorems and
>> proofs), but, as far as I know, there's no security proof using a recognised
>> PAKE security model.
> 
> I responded to a similar comment on the lightbluetouchpaper blog about 6 years ago:
> 

The comment from Jon Katz from 6 years ago is not really that similar to mine now, but I agree with him when he describes your security analysis as being hand waving.

> http://www.lightbluetouchpaper.org/2008/05/29/j-pake/ (See Comment 29)
> 
> My views are basically unchanged.

That's a shame. I'd have hoped you'd have learned how to use PAKE models and formal security proofs in the intervening period. 

> Meanwhile, in the past 6 years, I've been trying to search for answers of obvious questions: 1) what exact PAKE security model is the "right" model; 2) which exact PAKE protocol has been proved secure under that model and how is that protocol implemented and used in real life.

Very good. Models do evolve, and the first model is not always the "right" one. Still, the provision of some analysis in one of the several by now quite standard models would not be an unreasonable expectation if you are seriously promoting J-PAKE over the alternatives. 

> I must admit I haven't found my answers. 

Indeed. But that should not stop you (or anyone else, but it's really on you) from choosing one of the existing models and giving a proof for your protocol.

Cheers

Kenny

> Best regards,
> Feng
> 
>

[TLS] Should TLS 1.3 use an augmented PAKE by def… Andy Lutomirski
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Daniel Kahn Gillmor
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Andy Lutomirski
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Ryan Sleevi
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Andy Lutomirski
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Andy Lutomirski
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Ryan Sleevi
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Anders Rundgren
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Ryan Sleevi
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Peter Sylvester
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Andy Lutomirski
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Andy Lutomirski
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Yoav Nir
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Daniel Kahn Gillmor
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Paul Hoffman
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Yoav Nir
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Daniel Kahn Gillmor
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Robert Cragie
[TLS] bootstrapping of constrained devices (was: … Rene Struik
Re: [TLS] bootstrapping of constrained devices Anders Rundgren
Re: [TLS] bootstrapping of constrained devices (w… Michael Sweet
Re: [TLS] bootstrapping of constrained devices (w… t.petch
Re: [TLS] bootstrapping of constrained devices (w… Michael Sweet
Re: [TLS] bootstrapping of constrained devices Anders Rundgren
Re: [TLS] bootstrapping of constrained devices (w… Max Pritikin (pritikin)
Re: [TLS] bootstrapping of constrained devices (w… Don Sturek
Re: [TLS] bootstrapping of constrained devices Robert Cragie
Re: [TLS] bootstrapping of constrained devices Watson Ladd
Re: [TLS] bootstrapping of constrained devices Paterson, Kenny
Re: [TLS] bootstrapping of constrained devices Feng Hao
Re: [TLS] bootstrapping of constrained devices Paterson, Kenny
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Yaron Sheffer
Re: [TLS] Should TLS 1.3 use an augmented PAKE by… Yaron Sheffer
Re: [TLS] bootstrapping of constrained devices Feng Hao
Re: [TLS] bootstrapping of constrained devices Dan Harkins