Subject: [Cfrg] Internet Drafts on J-PAKE and Schnorr signature

From: Feng Hao <[email-masked]>
Date: Tue, 21 May 2013 20:33:43 +0100

Hi,

I just submitted two internet drafts for J-PAKE and Schnorr signature. The latter is a building block for the former, but I separated it out as the technique could be generally useful to other applications as well. 

I appreciate any comments or suggestions.

Regards,
Feng

Filename:	 draft-hao-jpake
Revision:	 00
Title:		 J-PAKE: Password Authenticated Key Exchange by Juggling
Creation date:	 2013-05-21
Group:		 Individual Submission
Number of pages: 10
URL:             http://www.ietf.org/internet-drafts/draft-hao-jpake-00.txt
Status:          http://datatracker.ietf.org/doc/draft-hao-jpake
Htmlized:        http://tools.ietf.org/html/draft-hao-jpake-00

Abstract:
   This document specifies a Password Authenticated Key Exchange by
   Juggling (J-PAKE) protocol.  This protocol allows the establishment
   of a secure end-to-end communication channel between two remote
   parties over an insecure network solely based on a shared password,
   without requiring a Public Key Infrastructure (PKI) or any trusted
   third party.

Filename:	 draft-hao-schnorr
Revision:	 00
Title:		 Schnorr Signature: Non-interactive Zero Knowledge Proof for Discrete Logarithm
Creation date:	 2013-05-21
Group:		 Individual Submission
Number of pages: 11
URL:             http://www.ietf.org/internet-drafts/draft-hao-schnorr-00.txt
Status:          http://datatracker.ietf.org/doc/draft-hao-schnorr
Htmlized:        http://tools.ietf.org/html/draft-hao-schnorr-00

Abstract:
   This document describes the Schnorr signature, a non-interactive
   variant of the three-pass Schnorr identification scheme.  The Schnorr
   signature allows one to prove the knowledge of a discrete logarithm
   without leaking its value.  It can serve as a useful building block
   for many cryptographic protocols to ensure the participants follow
   the protocol specification honestly.

---

From: Vadym Fedyukovych <[email-masked]>
Date: Wed, 22 May 2013 20:40:53 +0300

> I appreciate any comments or suggestions.

"..is a zero-knowledge proof primitive"
"It has been proven secure assuming that
       the verifier is honest and that the discrete logarithm problem is
       intractable"
"3.  Zero-knowledge: a prover leaks no more than one bit information
       to the verifier: whether the prover knows the discrete logarithm."

Simulator algorithm is not mentioned in zero knowledge definition is section 3.
Extractor algorithm and formal definition of proof of knowledge is missing.
"Replay attack" considerations may need be updated.

Honest verifier zero knowledge is a property of simulated transcript
indistinguishable from all session transcripts with verifiers
that honestly follow the protocol and choose the challenge at random (not as a hash).

Goldreich, O., Micali, S., Wigderson, A.
Proofs that yield nothing but their validity or all languages in {NP} have zero-knowledge proof systems
J. ACM 38(1) (1991) 691--729

Bellare, M., Goldreich, O.
On Defining Proofs of Knowledge

It may be reasonable to also mention DAA, Idemix, U-Prove
that treat user attributes just like private keys.

Regards,
Vadym

> ...
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg