[TLS] Symmetric PAKE for TLS

Schmidt, Jörn-Marc <Joern-Marc.Schmidt@secunet.com> Fri, 06 June 2014 09:25 UTC

From: =?iso-8859-1?Q?Schmidt=2C_J=F6rn-Marc?= <Joern-Marc.Schmidt@secunet.com>
To: "<tls@ietf.org>" <tls@ietf.org>
Thread-Topic: Symmetric PAKE for TLS
Thread-Index: Ac+BZl0orOotk0jDSUe2wzH1yJLRkA==
Date: Fri, 6 Jun 2014 09:24:48 +0000
Message-ID: <38634A9C401D714A92BB13BBA9CCD34F071673D1@mail-essen-01.secunet.de>
Accept-Language: de-DE, en-US
Content-Language: de-DE
Content-Type: multipart/alternative; boundary="_000_38634A9C401D714A92BB13BBA9CCD34F071673D1mailessen01secu_"
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/l1ZQuRSdethtoaBhFc0B7zRfZVU
Subject: [TLS] Symmetric PAKE for TLS
Precedence: list

Dear all,

I'd like to come back to a topic that has raised intensive discussions in the past: Introducing a symmetric PAKE scheme for TLS that supports ECC. I believe such a protocol is very useful, e.g. for enrollment of certificates on constrained devices like IP phones.



My proposal is to use PACE [1] with a flexible mapping to support Weierstrass as well as Montgomery and Edwards curves. The rationale behind this suggestion is:



- It's patent-free [2]

- It comes with a security proof [3]

- It received a lot of attention as it is used in European travel documents



I think the mapping of a random number to an ECC point that is used by the protocol should be very flexible, so that it is possible to use e.g. simplified SWU [4] for Weierstrass or Elligator [5] for Montgomery and Edwards. If you hold the appropriate license, you can even use Icart's function [6].



Cause of the intense previous discussion, I'd like to collect some opinions on the list before moving forward and writing a draft. Any feedback and thoughts are welcome.

Best,



Jörn





[1] BSI TR-03110 Advanced Security Mechanisms for Machine Readable Travel Documents

[2] PACE has been used in travel documents for years without patent discussions - the only critical thing is the mapping.

[3] Security Analysis of the PACE Key-Agreement Protocol. Jens Bender, Marc Fischlin and Dennis Kügler

[4] Efficient Indifferentiable Hashing into Ordinary Elliptic Curves. Eric Brier et. al

[5] http://elligator.cr.yp.to/

[6] How to Hash into Elliptic Curves. Thomas Icart

[TLS] Symmetric PAKE for TLS Schmidt