Re: [TLS] Augmented PAKE (Re: New Version Notification for draft-shin-tls-augpake-01.txt)

[Fabrice <[e-mail]>]

> On Nov 7, 2013, at 10:36, SeongHan Shin <[e-mail]> wrote:
> 
> Hi Fabrice,
> 
> Thank you for your comment!
> 
> Section 5.1 can be used in TLS 1.3 handshake (?) as in Eric's presentation :)

I haven't seen anything in the TLS1.3 flows document that would allow that.

> 
> >How does the client knows which group to use ?
> As you pointed out, we need to change Section 5.1 for the current tls version.
> A naive approach is to add one round exchange after ServerHello.
> Any other good ideas?

I guess you could only require the extra round trip for the first connection and have the client cache the group parameters somehow. 

But then you probably need a way for the client to tell the server which parameter it is using, so it can signal if the parameters match without going through the whole handshake. 

Also, your draft don't define new ciphersuites, like TLS-SRP does, so I don't think it's complete. 

   Fabrice 


> 
> Regards,
> Shin
> 
> 
>> On Fri, Nov 8, 2013 at 1:20 AM, Fabrice Gautier <[e-mail]> wrote:
>> Hi,
>> 
>> How does the client knows which group to use ?
>> 
>> As the client would need to know the group before sending the
>> ClientHello, it seems that the client needs to remember the groups
>> parameters along with the password, which seems impractical.
>> 
>> 
>> -- Fabrice
>> 
>> 
>> On Wed, Nov 6, 2013 at 11:25 AM, SeongHan Shin <[e-mail]> wrote:
>> > Dear all,
>> >
>> > For anyone who are interested in PAKE, pls see the below I-D regarding
>> > augmented PAKE.
>> >
>> > IMO, two reasons that SRP was published as RFC 2945 and included in IEEE
>> > 1363.2 and ISO/IEC 11770-4 are 1) SRP is an augmented PAKE and 2) the
>> > server's computation cost of SRP is a minimum.
>> > (Though SRP has no provable security)
>> >
>> > The AugPAKE in the below I-D is provably secure and more efficient than
>> > other augmented PAKEs (including SRP and AMP).
>> >
>> > Of course, augmented PAKE provides additional security property over
>> > (balanced) PAKE.
>> >
>> > Best regards,
>> > Shin
>> >
>> >
>> > On Wed, Sep 4, 2013 at 6:39 PM, SeongHan Shin <[e-mail]>
>> > wrote:
>> >>
>> >> Dear all,
>> >>
>> >> I submitted a new version of our I-D regarding augmented PAKE (AugPAKE)
>> >> and its integration into TLS.
>> >> I added some features of AugPAKE in Appendix.
>> >> Any comments are welcome!
>> >>
>> >> Best regards,
>> >> Shin
>> >>
>> >> ---------- Forwarded message ----------
>> >> From: <[e-mail]>
>> >> Date: Wed, Sep 4, 2013 at 6:26 PM
>> >> Subject: New Version Notification for draft-shin-tls-augpake-01.txt
>> >> To: Kazukuni Kobara <[e-mail]>, SeongHan Shin
>> >> <[e-mail]>
>> >>
>> >>
>> >>
>> >> A new version of I-D, draft-shin-tls-augpake-01.txt
>> >> has been successfully submitted by SeongHan Shin and posted to the
>> >> IETF repository.
>> >>
>> >> Filename:        draft-shin-tls-augpake
>> >> Revision:        01
>> >> Title:           Augmented Password-Authenticated Key Exchange for
>> >> Transport Layer Security (TLS)
>> >> Creation date:   2013-09-04
>> >> Group:           Individual Submission
>> >> Number of pages: 19
>> >> URL:
>> >> http://www.ietf.org/internet-drafts/draft-shin-tls-augpake-01.txt
>> >> Status:          http://datatracker.ietf.org/doc/draft-shin-tls-augpake
>> >> Htmlized:        http://tools.ietf.org/html/draft-shin-tls-augpake-01
>> >> Diff:
>> >> http://www.ietf.org/rfcdiff?url2=draft-shin-tls-augpake-01
>> >>
>> >> Abstract:
>> >>    This document describes an efficient augmented password-authenticated
>> >>    key exchange (AugPAKE) protocol where a user remembers a low-entropy
>> >>    password and its verifier is registered in the intended server.  In
>> >>    general, the user password is chosen from a small set of dictionary
>> >>    whose space is within the off-line dictionary attacks.  The AugPAKE
>> >>    protocol described here is secure against passive attacks, active
>> >>    attacks and off-line dictionary attacks (on the obtained messages
>> >>    with passive/active attacks), and also provides resistance to server
>> >>    compromise (in the context of augmented PAKE security).  Based on the
>> >>    AugPAKE protocol, this document also specifies a new password-only
>> >>    authentication handshake for Transport Layer Security (TLS) protocol.
>> >>
>> >>
>> >>
>> >>
>> >> Please note that it may take a couple of minutes from the time of
>> >> submission
>> >> until the htmlized version and diff are available at tools.ietf.org.
>> >>
>> >> The IETF Secretariat
>> >>
>> >>
>> >>
>> >>
>> >> --
>> >> ------------------------------------------------------------------
>> >> SeongHan Shin
>> >> Research Institute for Secure Systems (RISEC),
>> >> National Institute of Advanced Industrial Science and Technology (AIST),
>> >> Central 2, 1-1-1, Umezono, Tsukuba City, Ibaraki 305-8568 Japan
>> >> Tel : [phone]
>> >> Fax : [phone]
>> >> E-mail : [e-mail]
>> >> ------------------------------------------------------------------
>> >
>> >
>> >
>> >
>> > --
>> > ------------------------------------------------------------------
>> > SeongHan Shin
>> > Research Institute for Secure Systems (RISEC),
>> > National Institute of Advanced Industrial Science and Technology (AIST),
>> > Central 2, 1-1-1, Umezono, Tsukuba City, Ibaraki 305-8568 Japan
>> > Tel : [phone]
>> > Fax : [phone]
>> > E-mail : [e-mail]
>> > ------------------------------------------------------------------
>> >
>> > _______________________________________________
>> > TLS mailing list
>> > [e-mail]
>> > https://www.ietf.org/mailman/listinfo/tls
>> >
> 
> 
> 
> -- 
> ------------------------------------------------------------------
> SeongHan Shin
> Research Institute for Secure Systems (RISEC),
> National Institute of Advanced Industrial Science and Technology (AIST),
> Central 2, 1-1-1, Umezono, Tsukuba City, Ibaraki 305-8568 Japan
> Tel : [phone]
> Fax : [phone]
> E-mail : [e-mail]
> ------------------------------------------------------------------