Subject: [TLS] Symmetric PAKE for TLS

From: Schmidt, Jörn-Marc <[email-masked]>
Date: Fri, 6 Jun 2014 09:24:48 +0000

Dear all,

I'd like to come back to a topic that has raised intensive discussions in the past: Introducing a symmetric PAKE scheme for TLS that supports ECC. I believe such a protocol is very useful, e.g. for enrollment of certificates on constrained devices like IP phones.

My proposal is to use PACE [1] with a flexible mapping to support Weierstrass as well as Montgomery and Edwards curves. The rationale behind this suggestion is:

- It's patent-free [2]

- It comes with a security proof [3]

- It received a lot of attention as it is used in European travel documents

I think the mapping of a random number to an ECC point that is used by the protocol should be very flexible, so that it is possible to use e.g. simplified SWU [4] for Weierstrass or Elligator [5] for Montgomery and Edwards. If you hold the appropriate license, you can even use Icart's function [6].

Cause of the intense previous discussion, I'd like to collect some opinions on the list before moving forward and writing a draft. Any feedback and thoughts are welcome.

Best,

Jörn

[1] BSI TR-03110 Advanced Security Mechanisms for Machine Readable Travel Documents

[2] PACE has been used in travel documents for years without patent discussions - the only critical thing is the mapping.

[3] Security Analysis of the PACE Key-Agreement Protocol. Jens Bender, Marc Fischlin and Dennis Kügler

[4] Efficient Indifferentiable Hashing into Ordinary Elliptic Curves. Eric Brier et. al

[5] http://elligator.cr.yp.to/

[6] How to Hash into Elliptic Curves. Thomas Icart