Subject: [eap] question on bellare-rogaway

From: "Vanderveen, Michaela" <[email-masked]>
Date: Fri, 30 Sep 2005 17:59:41 -0400

Hello,

With the occasion of the EAP-PSK review at the last IETF, a question arose whether the
mutual authentication in this method is considered flawed for not following exactly the
classic (formally proven) Bellare-Rogaway protocol, in that one element is 
not communicated explicitly over the wire, but only used in the calculation of the MAC.

Not having attended that particular meeting, I am wondering if an opinion has formed as 
to whether this practice is acceptable in the cryptographic community. 
Better yet, does anyone know if there are any formal proofs of
modifications of the Bellare-Rogaway protocol that use the nonces in computations of
MACs but do not send them explicitly.

This question would be important for authentication protocols designed to run
over bandwidth-limited links.
Thanks,

Michaela

Michaela Vanderveen, Ph.D.
Advanced Networking
Flarion Technologies, Inc.
email: [email-masked]

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: "T. Charles Clancy" <[email-masked]>
Date: Mon, 3 Oct 2005 10:11:16 -0400 (EDT)

In my experience, omissions such as this do not lead to any real attacks. 
They only affect one's ability to formally prove the correctness of a 
protocol.  Just because something's harder to prove doesn't make it any 
less secure in terms of practical attacks.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]