Subject: Re: [Cfrg] SESPAKE password-authenticated key exchange protocol

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Thu, 31 Dec 2015 21:35:18 +0300

Dear colleagues!

We've translated our security proof of SESPAKE (
https://tools.ietf.org/html/draft-smyshlyaev-sespake-00) and published the
paper at ePrint archive:
http://eprint.iacr.org/2015/1237

A number of misprints can be in the current version (we'll correct them
before sending the paper to a peer-reviewed journal), but all our main
considerations and arguments for SESPAKE construction can be followed with
the help of this paper.

All necessary considerations regarding the draft with PAKE requirements are
in this paper, but nevertheless we'll prepare a separate paper on how
SESPAKE suits the current requirements list (with some considerations on
the requirements list itself).

Best regards and happy New Year!
Stanislav Smyshlyaev

2015-11-30 11:54 GMT+03:00 Stanislav V. Smyshlyaev <[email-masked]>:

> Dear colleagues,
>
> To make our contribution in the process with PAKE protocols, we've
> published a SESPAKE Internet Draft:
> https://tools.ietf.org/html/draft-smyshlyaev-sespake-00.
>
> The original document with SESPAKE is now an official document in the
> Russian standardization system: it was approved by the Russian
> standardization system (ROSSTANDART) Technical Committee on Cryptography
> (TC26) on 26 of November 2015.
>
> The current draft is based on the Russian algorithms only, but we are
> ready to widen it for the multi-algorithm support if it is considered
> necessary. The description of the protocol in the current draft is given in
> text form; a scheme is presented in my previous message.
>
> We are in process of translating our security proofs now – we hope to
> publish the document with the proofs on ePrint in the middle of December.
>
>
> Best regards,
> Stanislav V. Smyshlyaev, Ph.D.,
> Head of Information Security Department,
> CryptoPro LLC
>
>
> 2015-11-02 16:55 GMT+03:00 Stanislav V. Smyshlyaev <[email-masked]>:
>
>> Dear colleagues,
>>
>> We would like to take part in the process with PAKE protocols. We would
>> like to draw your attention to the protocol that is used (for a few years
>> already) in Russian cryptographic products (for the most relevant example
>> of a popular product, wireless cryptographic tokens).
>>
>> It is a processed document (in an editorial part now) in the Russian
>> standardization system; we've got a full security proof of the protocol
>> (including key authentication part); .
>>
>> During standardization process in Russia the protocol was named SESPAKE
>> (security evaluated standardized) – we are planning to continue using this
>> abbreviation in our future letters and documents regarding to it.
>>
>> In the current letter we provide a sketch description of the protocol. If
>> you do not mind, in a short time we will present a translated English
>> version of the security proof and considerations on connections between the
>> proposed protocol, the existing PAKE drafts (AugPAKE, SPAKE2, requirements)
>> and other PAKE schemes.
>>
>> We would be grateful for any comments and for taking part in the process
>> with considering SESPAKE protocol in CFRG/IRTF/IETF.
>>
>>
>>
>> A stores:                          |         |   B stores:
>>
>>  * PW                              |         |    * ind in {1,...,N}
>>
>>  * A_ID                            |         |    * salt
>>
>>  * {Q_1, ..., Q_N}                 |         |    * QB_PW (or PW and
>> Q_ind)
>>
>> =================================================================================
>>            A                       |         |               B
>>
>> =================================================================================
>>                                    |  A_ID   |
>>                                    |-------->|
>>                                    |         |
>>                                    |ind,salt |
>>                                    |<--------|
>>                                    |         |
>>  * w = int( F(PW, salt) )          |         |
>>  * QA_PW = w * Q_ind               |         |
>>  * z_A = 0                         |         |
>>  * a = random from {1,...,q-1}     |         |
>>  * u_1 = a * P - QA_PW             |         |
>>                                    |   u_1   |
>>                                    |-------->|
>>                                    |         | * if u_1 not on E
>>                                    |         |   => FINISH
>>                                    |         | * Q_B = u_1 + QB_PW
>>                                    |         | * z_B = 0
>>                                    |         | * b = random from
>> {1,...,q-1}
>>                                    |         | * if (m/q) * Q_B == 0_E
>>                                    |         |   => Q_B = P
>>                                    |         |   => z_B = 1
>>                                    |         | * src = ( (m/q) * b mod q
>> ) * Q_B
>>                                    |         | * K_B = H_256(src)
>>                                    |         | * u_2 = b * P + QB_PW
>>                                    |   u_2   |
>>                                    |<--------|
>>  * if u_2 not on E                 |         |
>>    => FINISH                       |         |
>>  * Q_A = u_2 - QA_PW               |         |
>>  * if (m/q) * Q_A == 0_E           |         |
>>    => Q_A = P                      |         |
>>    => z_A = 1                      |         |
>>  * src = ( (m/q) * a mod q ) * Q_A |         |
>>  * K_A = H_256(src)                |         |
>>
>> ---------------------------------------------------------------------------------
>>  * src_MAC =                       |         |
>>    = TA||A_ID||ind||salt||u_1||u_2 |         |
>>  * M_A = HMAC_{K_A}( src_MAC )     |         |
>>                                    |   M_A   |
>>                                    |-------->|
>>                                    |         | * srcA_MAC =
>>                                    |         |   =
>> TA||A_ID||ind||salt||u_1||u_2
>>                                    |         | * M = HMAC_{K_B}( srcA_MAC
>> )
>>                                    |         | * if ( M != M_A ) or ( z_B
>> != 0 )
>>                                    |         |   => FINISH
>>                                    |         | * src_MAC =
>>                                    |         |   =
>> TB||A_ID||ind||salt||u_1||u_2
>>                                    |         | * M_B = HMAC_{K_B}(
>> src_MAC )
>>                                    |   M_B   |
>>                                    |<--------|
>>  * srcB_MAC =                      |         |
>>    = TB||A_ID||ind||salt||u_1||u_2 |         |
>>  * M = HMAC_{K_A}( srcB_MAC )      |         |
>>  * if ( M != M_B ) or ( z_A != 0 ) |         |
>>    => FINISH                       |         |
>>                                    |         |
>>
>>
>>
>>
>> Best regards,
>> Stanislav V. Smyshlyaev, Ph.D.,
>> Head of Information Security Department,
>> CryptoPro LLC
>>
>
>