[TLS] Security of OPAQUE in TLS

Hugo Krawczyk <hugokraw@gmail.com> Wed, 27 March 2019 02:58 UTC

MIME-Version: 1.0
From: Hugo Krawczyk <hugokraw@gmail.com>
Date: Tue, 26 Mar 2019 22:57:32 -0400
Message-ID: <CADi0yUOuMDk7sY-XE6-SVisG=5a7eJHPZnzwMmLWiNa+N+E4Vg@mail.gmail.com>
To: "<tls@ietf.org>" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000df18e605850a9bb3"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/noDzS4Nze0hk9k6QAmWtR9jC5rg>
Subject: [TLS] Security of OPAQUE in TLS
Precedence: list

In the TLS meeting on Tuesday, Kenny asked about the analysis of OPAQUE in
the context of TLS. One important property of OPAQUE is that its design and
analysis is modular. It applies to the composition of *any* OPRF with *any*
(KCI-secure) key exchange. This is why we can integrate OPAQUE with
different KE protocols including TLS 1.3 and get a combined proof of
security. Of course, these high level analyses do not take into account all
the details in a complex protocol like TLS 1.3 so any more specific
analysis, including those using automated tools (Tamarin, Everest, etc)
would be more than welcome.  However, if there is interest in defining an
asymmetric PAKE for TLS to replace old designs such as SRP then we can
start moving towards that goal with the draft Nick presented.  This will
also motivate more analysts (including those based on tools like the above)
to look into this question  more seriously.

Hugo

[TLS] Security of OPAQUE in TLS Hugo Krawczyk