Subject: [Cfrg] RFC 7664 on Dragonfly Key Exchange

From: [email-masked]
Date: Wed, 11 Nov 2015 17:00:04 -0800 (PST)

A new Request for Comments is now available in online RFC libraries.

        RFC 7664

        Title:      Dragonfly Key Exchange 
        Author:     D. Harkins, Ed.
        Status:     Informational
        Stream:     IRTF
        Date:       November 2015
        Mailbox:    [email-masked]
        Pages:      18
        Characters: 37576
        Updates/Obsoletes/SeeAlso:   None

        I-D Tag:    draft-irtf-cfrg-dragonfly-08.txt

        URL:        https://www.rfc-editor.org/info/rfc7664

        DOI:        http://dx.doi.org/10.17487/RFC7664

This document specifies a key exchange using discrete logarithm
cryptography that is authenticated using a password or passphrase.
It is resistant to active attack, passive attack, and offline
dictionary attack.  This document is a product of the Crypto Forum
Research Group (CFRG).

This document is a product of the Crypto Forum Research Group of the IRTF.

INFORMATIONAL: This memo provides information for the Internet community.
It does not specify an Internet standard of any kind. Distribution of
this memo is unlimited.

This announcement is sent to the IETF-Announce, rfc-dist and IRTF-Announce lists.To subscribe or unsubscribe, see
  https://www.ietf.org/mailman/listinfo/ietf-announce
  https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist
  https://www.irtf.org/mailman/listinfo/irtf-announce

For searching the RFC series, see https://www.rfc-editor.org/search
For downloading RFCs, see https://www.rfc-editor.org/rfc.html

Requests for special distribution should be addressed to either the
author of the RFC in question, or to [email-masked].  Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.

The RFC Editor Team
Association Management Solutions, LLC

---

From: Watson Ladd <[email-masked]>
Date: Wed, 11 Nov 2015 20:18:30 -0500

Dear all,
This protocol does not match the one whose security was proven. The
modification is cheap: include identities in the Confirmation
Exchange. It's specifically suggested in the text. Why was this not
done?

Sincerely,
Watson

On Wed, Nov 11, 2015 at 8:00 PM,  <[email-masked]> wrote:
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.

---

From: Tony Arcieri <[email-masked]>
Date: Wed, 11 Nov 2015 19:12:47 -0800

> Exchange. It's specifically suggested in the text. Why was this not

I second this and also I find the "Security Considerations" section of this
draft incredibly misleading. Specifically it claims:

This key exchange protocol has received cryptanalysis in [clarkehao].
[lanskro] provides a security proof of Dragonfly in the random oracle model
when both identities are included in the data sent in the Confirm Exchange
(see Section 3.4).

This is, at best, a rather "rose colored glasses" interpretation of the
actual [clarkehao] paper:

https://eprint.iacr.org/2013/058.pdf

In this paper, we examine the security properties of the Dragonfly
protocol. Contrary to the author’s claims, we show that both variants are
subject to an off-line dictionary attack. In this paper, we will base our
analysis upon the original protocol specification as defined in a
peer-reviewed paper [1]. However, the attack we will present is trivially
applicable to the variant specified in [2]. (According to the Dragonfly
author, the current Internet draft, which expires on April 15, 2013 [2],
will be changed soon in light of our reported attack.)

I would suggest the protocol be updated as Watson suggests, and that the
wording in "Security Considerations" be modified to clarify the attacks
discovered in the cited [clarkehao] paper and how they have (not yet, but
should be per [lanskro]) been remediated.

-- 
Tony Arcieri

---

From: Andy Lutomirski <[email-masked]>
Date: Wed, 11 Nov 2015 20:04:27 -0800

> draft incredibly misleading. Specifically it claims:

I don't think it's a draft.  I think it's for real.  This change
happened between draft 8 and the published RFC:

https://www.ietf.org/rfcdiff?url1=draft-irtf-cfrg-dragonfly-08&url2=rfc7664&difftype=--html

AFAICT this changed in the editing process.  I don't know what, if
anything, can be done about this at this point, but arguably an
erratum should be published or this RFC should be withdrawn.

Also, this seems odd to me.  Why is there no final consensus call on
the document that is actually intended to be final?  ISTM there's very
little chance that this particular document would receive consensus.

--Andy

---

From: "Dan Harkins" <[email-masked]>
Date: Thu, 12 Nov 2015 04:51:28 -0800 (PST)

>> Exchange. It's specifically suggested in the text. Why was this not

  I wanted to do that but was told not to by one of the chairmen
because that was not the exchange that was reviewed by the group.

> actual [clarkehao] paper:

  It is nothing of the sort. That comment refers to the -00
version of the draft which was rushed to get out before an I-D
cut-off date-- to see how rushed, note the "Acknowledgements"
section of the draft is the xml2rfc boilerplate. In my haste
I failed to include a check to validate received elements (note
that EAP-pwd which uses the exchange and was published before
the draft was written includes element validation so it was
part of the exchange, just not included in the -00 version).

> should be per [lanskro]) been remediated.

  I would kindly suggest you read the RFC and then read the
full paper because it is plainly obvious that you didn't get
past the introduction.

  regards,

  Dan.

---

From: Tony Arcieri <[email-masked]>
Date: Thu, 12 Nov 2015 12:43:13 -0800

> part of the exchange, just not included in the -00 version).

That section also claims that Dragonfly was proven under the random oracle
model, then goes on to describe a version that wasn't... don't you think
that's misleading?

-- 
Tony Arcieri

---

From: "Dan Harkins" <[email-masked]>
Date: Thu, 12 Nov 2015 22:33:13 -0800 (PST)

> model, then goes on to describe a version that wasn't... don't you think

  No, that section describes exactly what was proven secure
under the random oracle model.

  Give it a rest dude.

  Dan.

---

From: Andy Lutomirski <[email-masked]>
Date: Thu, 12 Nov 2015 22:40:28 -0800

> under the random oracle model.

It's a security claim in a paper from a security group, and the claim was
not, by any stretch of the imagination, reviewed by the group.

--Andy