Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd

["Dan Harkins" <[e-mail]>]

On Thu, December 5, 2013 12:42 pm, Trevor Perrin wrote:
> On Thu, Dec 5, 2013 at 10:40 AM, Dan Harkins <[e-mail]> wrote:
>>> See the discussion around SRP that occurred when you first presented
>>> this.  Any patent FUD which *might* have existed, once, has expired:
>>>
>>> http://www.ietf.org/mail-archive/web/tls/current/msg08203.html
>>> http://www.ietf.org/mail-archive/web/tls/current/msg08191.html
>>
>>   Yes I am aware that the original EKE patent expired. But EKE cannot be
>> used with elliptic curves.
>
> Not true, for example see Hamburg and Bernstein's Elligator 2 [1],
> which could be used as the basis for a DH-EKE style PAKE.

  Now THAT is an interesting alternative.

  But, alas, the benefit of doing that is uncompelling to you so I don't
know why you mention it. According to you the cryptographic difference
provided by EKE using Elligator public keys has nothing to do with the
architectural differences that you insist are behind the disinterest
(according to you) of PAKE protocols in TLS.

> We should not standardize protocols which are inferior to existing
> ones and to newer alternatives, have insufficient cryptographic
> analysis, have no application, and have no support in the WG beside
> the draft authors and the NSA [2].

  That is just pathetic FUD and a really lame smear. You should be
ashamed of yourself.

> I remain opposed.

  And you even would be opposed to alternatives you suggest instead
(see above). You helped out on TLS-SRP and are opposed to anyone
doing anything else. That is quite obvious.

  Dan.

>
> Trevor
>
> [1] https://eprint.iacr.org/2013/325.pdf
> [2] http://www.ietf.org/mail-archive/web/tls/current/msg08371.html
>