Subject: [Cfrg] [CFRG] Pake Selection process

From: Björn Haase <[email-masked]>
Date: Fri, 26 Jul 2019 10:51:29 +0000

Hello to all,

before leaving on vacation, I have two contributions regarding the PAKE selection process.

1.) I today have added a number of slides regarding our Experience at E+H regarding the integration of augmented PAKE into our wireless service acess APPs.

https://github.com/BjoernMHaase/fe25519/blob/master/Concept_For_Modularized_PAKE_integration_into_TLS_20190726.pdf

(Today I did add a number of additional slides to the older presentation that was mentioned yesterday. For reference, I did keep the older version on the server at
https://github.com/BjoernMHaase/fe25519/blob/master/Concept_For_Modularized_PAKE_integration_into_TLS_20190720.pdf )

2.) I see the need to rectify an assessment in our responses to CFRG regarding the protocol properties of AuCPace / CPace in https://eprint.iacr.org/2018/286.pdf when dealing with quantum-computing.

We did write:

“AuCPace has not been analyzed with respect to adversaries able to calculate the discrete logarithm ("quantum adversaries"). Anything we could give here in absence of a clear security model is somewhat hand-waving.  […] For this setting, we believe that for passive adversaries, we would not be having any additional capabilities of a "quantum-adversary", since for passive adversaries we still would be having information-theoretic security for the GuessK problem from section 4.3”

The last sentence was not correct. In fact a quantum adversary could always mount a “quantum dictionary attack” and this does not only apply to active adversaries only but also holds for passive adversaries.

Mit freundlichen Grüßen I Best Regards 

Dr. Björn Haase 

Senior Expert Electronics | TGREH Electronics Hardware
Endress+Hauser Conducta GmbH+Co.KG | Dieselstrasse 24 | 70839 Gerlingen | Germany
Phone: +49 7156 209 377 | Fax: +49 7156 209 221
[email-masked] |  www.conducta.endress.com 

Endress+Hauser Conducta GmbH+Co.KG
Amtsgericht Stuttgart HRA 201908
Sitz der Gesellschaft: Gerlingen
Persönlich haftende Gesellschafterin:
Endress+Hauser Conducta Verwaltungsgesellschaft mbH
Sitz der Gesellschaft: Gerlingen
Amtsgericht Stuttgart HRA 201929
Geschäftsführer: Dr. Manfred Jagiella

Gemäss Datenschutzgrundverordnung sind wir verpflichtet, Sie zu informieren, wenn wir personenbezogene Daten von Ihnen erheben.
Dieser Informationspflicht kommen wir mit folgendem Datenschutzhinweis (https://www.endress.com/de/cookies-endress+hauser-website) nach.

Disclaimer: 

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you receive this in error, please contact the sender and delete the material from any computer. This e-mail does not constitute a contract offer, a contract amendment, or an acceptance of a contract offer unless explicitly and conspicuously designated or stated as such.

---

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Fri, 26 Jul 2019 07:05:52 -0400

Thank you for these updates, Björn!

Regards,
Stanislav

пт, 26 июля 2019 г. в 6:52, Björn Haase <[email-masked]>:

> 1.) I today have added a number of slides regarding our Experience at E+H
> regarding the integration of augmented PAKE into our wireless service acess
> APPs.
>
>
>
>
> (Today I did add a number of additional slides to the older presentation
> that was mentioned yesterday. For reference, I did keep the older version
> on the server at
>
>
> 2.) I see the need to rectify an assessment in our responses to CFRG
> regarding the protocol properties of AuCPace / CPace in
> https://eprint.iacr.org/2018/286.pdf when dealing with quantum-computing.
>
>
>
> We did write:
>
>
>
> “AuCPace has not been analyzed with respect to adversaries able to
> calculate the discrete logarithm ("quantum adversaries"). Anything we could
> give here in absence of a clear security model is somewhat hand-waving.
>  […] For this setting, we believe that for passive adversaries, we would
> not be having any additional capabilities of a "quantum-adversary", since
> for passive adversaries we still would be having information-theoretic
> security for the GuessK problem from section 4.3”
>
>
>
> The last sentence was not correct. In fact a quantum adversary could
> always mount a “quantum dictionary attack” and this does not only apply to
> active adversaries only but also holds for passive adversaries.
>
>
>
>
> ------------------------------
> ------------------------------
>
> ------------------------------
>
> Gemäss Datenschutzgrundverordnung sind wir verpflichtet, Sie zu
> informieren, wenn wir personenbezogene Daten von Ihnen erheben.
>
> Dieser Informationspflicht kommen wir mit folgendem Datenschutzhinweis
> <https://www.de.endress.com/de/cookies-endress+hauser-website> nach.
> ------------------------------
>
>
>
> Disclaimer:
>
> The information transmitted is intended only for the person or entity to
> which it is addressed and may contain confidential, proprietary, and/or
> privileged
> material. Any review, retransmission, dissemination or other use of, or
> taking of any action in reliance upon, this information by persons or
> entities
> other than the intended recipient is prohibited. If you receive this in
> error, please contact the sender and delete the material from any computer.
> This e-mail does not constitute a contract offer, a contract amendment, or
> an acceptance of a contract offer unless explicitly and conspicuously
> designated or stated as such.
>
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>