[TLS] The PAKE question and PSK

[Watson Ladd <[e-mail]>]

Dear all,

I'm afraid that several important points and quite a bit of history
has been missing from the recent exchange concerning Dragonfly in TLS.

Dragonfly is a modified SPEKE. SPEKE was introduced in 2001. SPEKE has
a patent that expires in 2016, and a security proof in the ROM under a
DH style assumption and a reasonable ideal/real attack model.
Dragonfly was created by Dan Harkins, and adopted in IEEE 802.11s to
authenticate nodes in a mesh network. It has no security proof despite
efforts to try and find one.

The intended usecase is provisioning of constrained devices. While one
could include a 128 bit key on each device and have users type it in
(as they do for Xbox Live and Windows verification: 25 letters and
numbers from a 32 bit alphabet) it was felt that this was a bit much.
PSK will not work with anything that isn't a key, because offline
attack works beautifully. Nico's concerns about key database
compromise, etc, are ignoring the realities of this setting: the
password is the least valuable thing on the device, and since it was
not entered by the user (as the device has no user interaction
capability) unlikely to be reused.

Dragonfly was presented at IETF 83. AugPAKE was proven secure in 2010.
There is currently a draft for AugPAKE in TLS. Unfortunately AugPAKE
is not specified on ECC groups, but this is easy to fix. (It's also
ugly to shoehorn into TLS, but the draft seems to do it) PAKEs are not
on the agenda because of a rather heated controversy about how
Dragonfly got (seeming) CFRG approval, but there is a good case for
including them. On the web we have more of a problem due to the UI
issues that made client certificates a nonstarter.

Sincerely,
Watson Ladd