Subject: [Cfrg] I-D Action: draft-irtf-cfrg-augpake-02.txt

From: [email-masked]
Date: Wed, 06 Aug 2014 07:12:08 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Crypto Forum Research Group Working Group of the IETF.

        Title           : Augmented Password-Authenticated Key Exchange (AugPAKE)
        Authors         : SeongHan Shin
                          Kazukuni Kobara
	Filename        : draft-irtf-cfrg-augpake-02.txt
	Pages           : 20
	Date            : 2014-08-06

Abstract:
   This document describes a secure and highly-efficient augmented
   password-authenticated key exchange (AugPAKE) protocol where a user
   remembers a low-entropy password and its verifier is registered in
   the intended server.  In general, the user password is chosen from a
   small set of dictionary whose space is within the off-line dictionary
   attacks.  The AugPAKE protocol described here is secure against
   passive attacks, active attacks and off-line dictionary attacks (on
   the obtained messages with passive/active attacks).  Also, this
   protocol provides resistance to server compromise in the context that
   an attacker, who obtained the password verifier from the server, must
   at least perform off-line dictionary attacks to gain any advantage in
   impersonating the user.  The AugPAKE protocol is not only provably
   secure in the random oracle model but also the most efficient over
   the previous augmented PAKE protocols (SRP and AMP).

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-irtf-cfrg-augpake/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-irtf-cfrg-augpake-02

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-augpake-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: SeongHan Shin <[email-masked]>
Date: Wed, 6 Aug 2014 23:55:06 +0900

Dear all,

I've submitted a new version of the I-D.
I added AugPAKE in the EC setting to Appendix C.

Any comments are welcome!
Best regards,
Shin

On Wed, Aug 6, 2014 at 11:12 PM, <[email-masked]> wrote:

> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg
>

-- 
------------------------------------------------------------------
SeongHan Shin
Research Institute for Secure Systems (RISEC),
National Institute of Advanced Industrial Science and Technology (AIST),
Central 2, 1-1-1, Umezono, Tsukuba City, Ibaraki 305-8568 Japan
Tel : +81-29-861-2670/5284
Fax : +81-29-861-5285
E-mail : [email-masked]
------------------------------------------------------------------

---

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 6 Aug 2014 18:16:49 +0300

> http://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-augpake-02

Did a quick read of changes:

Appendix C:

"If the received X from user U is not a point on E or [2^n] * X = 0_E,"

Should this be:

If the received X from user U is not a point on E or [k] * X = 0_E,

Similarly, there is:

"If the received Y from server S is not a point on E or	[2^n] * Y = 0_E,"

Should this be:

"If the received Y from server S is not a point on E or [k] * Y = 0_E,"

Rationale:

k is the cofactor, which may be ("optionally") power of two, it may
not be 2^n.

Also:

"The cofactor k is the value (#E / q) satisfying k = 2^n * q_1 * q_2	
...  q_t where n = {0,1,2} and every primes q_i > q for i = 1, 2,	
..., t."

q_i are bigger than q? Isn't q usually chosen to be the biggest prime
factor of #E?

Also, for some curves one might want to use (due to good performance
and security), k=8.

-Ilari

---

From: SeongHan Shin <[email-masked]>
Date: Fri, 8 Aug 2014 15:01:13 +0900

Dear Ilari,

Thank you for your comments!

>k is the cofactor, which may be ("optionally") power of two, it may

In Appendix C, we set k = 2^n * q_1 * q_2 ...  q_t where n = {0,1,2} and
every primes q_i > q for i = 1, 2, ..., t (or optionally k = 2^n).
With this cofactor k, checking [2^n] * X =/ 0_E and [2^n] * Y =/ 0_E is
enough to exclude elements whose
group order is smaller than q. Now, X and Y are elements whose group order
is q or greater than q.

Of course, if k = 2^n * M where M is a composite integer whose factors are
< q,
the check should be [k] * X =/ 0_E and [k] * Y =/ 0_E as you recommended.

>q_i are bigger than q? Isn't q usually chosen to be the biggest prime
As above, by using this cofactor k (or k = 2^n)
one can avoid the order check of elements received from the other party.

>Also, for some curves one might want to use (due to good performance
I'll add this to the I-D.

Best regards,
Shin