Subject: [Cfrg] "JPAKE & BPKDF2"-based Authentication Scheme

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Mon, 12 May 2014 15:10:31 -0400

Hi,

We had an initial discussion on the SAAG mailing list regarding the
Key-Derivation idea with the challenge-response framework; here is the
beginning of that thread:
http://www.ietf.org/mail-archive/web/saag/current/msg04964.html

Per that discussion there was some interest on discussing the same idea but
by using a PAKE protocol instead.

I have put together the following flow based on the JPAKE draft (
http://datatracker.ietf.org/doc/draft-hao-jpake/), with some help from Feng
Hao (co-author of the JPAKE protocol),
on how would a JPAKE protocol fit into the challenge-response framework.

The flow describes how could JPAKE and BPKDF2 protocols be used in a
challenge-response framework.
The BPKDF2 protocol is used to create a master-key on both the client and
the server without sending the master-key on the wire.
While the example is using BPKDF2, we could easily use Scrypt instead.

The master-key is then used as an input to the JPAKE protocol.
On the JPAKE side, the flow uses the Three-pass Variant (section 2.3 of
JPAKE draft) merged with the Key Confirmation (section 2.4 of JPAKE draft).

I will be using the following notations in the flow below:

   o x1: first ephemeral-private-key created by the client
   o x2: second ephemeral-private-key created by the client
   o x3: first ephemeral-private-key created by the server
   o x4: second ephemeral-private-key created by the server

   o epk-x1: ephemeral-public-key associated with x1
   o epk-x2: ephemeral-public-key associated with x2
   o epk-x3: ephemeral-public-key associated with x3
   o epk-x4: ephemeral-public-key associated with x4

   o pop-x1: proof-of-possession of x1
   o pop-x2: proof-of-possession of x2
   o pop-x3: proof-of-possession of x3
   o pop-x4: proof-of-possession of x4
   o pop-x2-mk: proof-of-possession of (x2*master-key)
   o pop-x4-mk: proof-of-possession of (x4*master-key)

   o cpk: client-public-key
   o spk: server-public-key

   o cck-h: client-confirmation-key-hash
   o sck-h: server-confirmation-key-hash

User account on the server:
1. Select: KDF, salt, iteration-count, key-length
2. master-key = KDF(Password, Salt, Iterations, Key-Size)
3. Store in DB: username, salt, iterations, master-key

Client                                                        Server
 -------------------------------------------------------------------
  |                                                              |
epk-x1 = g^{x1} mod p                                            |
epk-x2 = g^{x2} mod p                                            |
  |                                                              |
  | Initial-Request                                              |
  |   epk-x1, epk-x2, pop-x1, pop-x2                             |
  |------------------------------------------------------------->|
  |                                                              |
  |                          spk = g^{(x1+x2+x3)*x4*master-key} mod p
  |                                             epk-x3 = g^{x3} mod p
  |                                             epk-x4 = g^{x4} mod p
  |                                                              |
  |                       Challenge                              |
  |                         spk, epk-x3, epk-x4,                 |
  |                         pop-x3, pop-x4, pop-x4-mk            |
  |                         kdf, salt, key-size, iteration-count |
  |<-------------------------------------------------------------|
  |                                                              |
master-key = kdf(password, salt, iterations, key-size)           |
shared-key = (spk/g^{x2*x4*master-key})^{x2} mod p               |
session-key = kdf(shared-key)                                    |
cok = kdf(session-key || "JPAKE_KC")                             |
cpk = g^{(x1+x3+x4)*x2*master-key} mod p                         |
cck-h = H(H(cok))                                                |
  |                                                              |
  | Response                                                     |
  |   cpk, cok-ch, pop-x2-mk                                     |
  |------------------------------------------------------------->|
  |                                                              |
  |                shared-key = (cpk/g^{x2*x4*master-key})^{x4} mod p
  |                                     session-key = KDF(shared-key)
  |                              cok = kdf(session-key || "JPAKE_KC")
  |                                                    sck-h = H(cok)
  |                                                              |
  |                                                 Confirmation |
  |                                                   sck-h      |
  |<-------------------------------------------------------------|
  |                                                              |

The bottom line is that based on this initial investigation it seems that
the combination of PBKDF2 and JPAKE could fit into the challenge-response
framework.
Any thoughts, comments?

Regards,
 Rifaat