Subject: [Cfrg] Fwd: SESPAKE password-authenticated key exchange protocol

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Mon, 2 Nov 2015 22:12:41 +0400

Dear colleagues,

We would like to take part in the process with PAKE protocols. We would
like to draw your attention to the protocol that is used (for a few years
already) in Russian cryptographic products (for the most relevant example
of a popular product, wireless cryptographic tokens).

It is a processed document (in an editorial part now) in the Russian
standardization system; we've got a full security proof of the protocol
(including key authentication part); .

During standardization process in Russia the protocol was named SESPAKE
(security evaluated standardized) – we are planning to continue using this
abbreviation in our future letters and documents regarding to it.

In the current letter we provide a sketch description of the protocol. If
you do not mind, in a short time we will present a translated English
version of the security proof and considerations on connections between the
proposed protocol, the existing PAKE drafts (AugPAKE, SPAKE2, requirements)
and other PAKE schemes.

We would be grateful for any comments and for taking part in the process
with considering SESPAKE protocol in CFRG/IRTF/IETF.

A stores:                          |         |   B stores:
 * PW                              |         |    * ind in {1,...,N}
 * A_ID                            |         |    * salt
 * {Q_1, ..., Q_N}                 |         |    * QB_PW (or PW and Q_ind)
=================================================================================
           A                       |         |               B
=================================================================================
                                   |  A_ID   |
                                   |-------->|
                                   |         |
                                   |ind,salt |
                                   |<--------|
                                   |         |
 * w = int( F(PW, salt) )          |         |
 * QA_PW = w * Q_ind               |         |
 * z_A = 0                         |         |
 * a = random from {1,...,q-1}     |         |
 * u_1 = a * P - QA_PW             |         |
                                   |   u_1   |
                                   |-------->|
                                   |         | * if u_1 not on E
                                   |         |   => FINISH
                                   |         | * Q_B = u_1 + QB_PW
                                   |         | * z_B = 0
                                   |         | * b = random from {1,...,q-1}
                                   |         | * if (m/q) * Q_B == 0_E
                                   |         |   => Q_B = P
                                   |         |   => z_B = 1
                                   |         | * src = ( (m/q) * b mod q )
* Q_B
                                   |         | * K_B = H_256(src)
                                   |         | * u_2 = b * P + QB_PW
                                   |   u_2   |
                                   |<--------|
 * if u_2 not on E                 |         |
   => FINISH                       |         |
 * Q_A = u_2 - QA_PW               |         |
 * if (m/q) * Q_A == 0_E           |         |
   => Q_A = P                      |         |
   => z_A = 1                      |         |
 * src = ( (m/q) * a mod q ) * Q_A |         |
 * K_A = H_256(src)                |         |
---------------------------------------------------------------------------------
 * src_MAC =                       |         |
   = TA||A_ID||ind||salt||u_1||u_2 |         |
 * M_A = HMAC_{K_A}( src_MAC )     |         |
                                   |   M_A   |
                                   |-------->|
                                   |         | * srcA_MAC =
                                   |         |   =
TA||A_ID||ind||salt||u_1||u_2
                                   |         | * M = HMAC_{K_B}( srcA_MAC )
                                   |         | * if ( M != M_A ) or ( z_B
!= 0 )
                                   |         |   => FINISH
                                   |         | * src_MAC =
                                   |         |   =
TB||A_ID||ind||salt||u_1||u_2
                                   |         | * M_B = HMAC_{K_B}( src_MAC )
                                   |   M_B   |
                                   |<--------|
 * srcB_MAC =                      |         |
   = TB||A_ID||ind||salt||u_1||u_2 |         |
 * M = HMAC_{K_A}( srcB_MAC )      |         |
 * if ( M != M_B ) or ( z_A != 0 ) |         |
   => FINISH                       |         |
                                   |         |

Best regards,
Stanislav V. Smyshlyaev, Ph.D.,
Head of Information Security Department,
CryptoPro LLC

---

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Mon, 30 Nov 2015 11:54:49 +0300

Dear colleagues,

To make our contribution in the process with PAKE protocols, we've
published a SESPAKE Internet Draft:
https://tools.ietf.org/html/draft-smyshlyaev-sespake-00.

The original document with SESPAKE is now an official document in the
Russian standardization system: it was approved by the Russian
standardization system (ROSSTANDART) Technical Committee on Cryptography
(TC26) on 26 of November 2015.

The current draft is based on the Russian algorithms only, but we are ready
to widen it for the multi-algorithm support if it is considered necessary.
The description of the protocol in the current draft is given in text form;
a scheme is presented in my previous message.

We are in process of translating our security proofs now – we hope to
publish the document with the proofs on ePrint in the middle of December.

Best regards,