Re: [TLS] [Cfrg] Review of Dragonfly PAKE

[Trevor Perrin <[e-mail]>]

On Wed, Dec 11, 2013 at 2:07 PM, Dan Harkins <[e-mail]> wrote:
>
> On Wed, December 11, 2013 11:50 am, Trevor Perrin wrote:
>> On Tue, Dec 10, 2013 at 5:35 PM, Dan Harkins <[e-mail]> wrote:
> [snip]
>>>   It makes little sense to negotiate a 256-bit or even a 128-bit
>>> cipher or a hash algorithm with a 256-bit or 512-bit digest size
>>> when the domain parameter set is fixed to a 1024-bit FFC group.
>>> What makes sense is to allow for negotiation of a 4096-bit FFC
>>> group or a 256-bit ECC group along with your AES-GCM-128
>>> with key derivation using HMAC-256.
>>
>> It makes little sense to use a 1024-bit FFC group in any circumstances
>> because (pardon me, Kevin) - fuck the NSA.
>
>   That certainly is a fashionable pose to strike these days!
>
>   But I brought up binding a 1024-bit FFC to a password because that's
> what an RFC with your name on it does.

RFC 5054 has a range of DH groups.  I would've preferred not to
include the lower-strength ones.

Care to respond to any other points, or can we assume Dragonfly is
debunked at this point?


Trevor