Subject: [http-auth] Mutual: ticket #9

From: Yutaka OIWA <[email-masked]>
Date: Wed, 23 Jul 2014 22:55:47 +0900

Dear all,

Regarding the open ticket #9
(http://trac.tools.ietf.org/wg/httpauth/trac/ticket/9),

As the crypto primitive is involved, simple-enough, detailed-enough
"crypto-style"
notion is quite difficult.
It may possibly go to something like "C->S: f1(n), S->C: f2(m, n),
C->S: f3(m, n, o)...."
in extreme, which is quite non-meaningful.

Seeking for some compromise level, I made some "still-complicated" version
which may be helpful for some readers, attached below.
It omits all kinds of "group" operations (mod q, mod r, etc.), hiding
all details
of hashing, and so many other things such as border-case error handling.
If this is satisfactory for readers in this working group, I'd like to
add it to the
next revisions of the "algo" draft.
Comments are really appreciated.

========

   C: S_c1 = random
   C: K_c1 = g^(S_c1)
                    ----- id, K_c1 ----->
   C: t_1 = H1(K_c1)                S: t_1 = H1(K_c1)
                                    S: fetch J = g^pi by id
                                    S: S_s1 = random
                                    S: K_s1 = (J * K_c1^(t_1))^(S_s1)
                    <----- K_s1 -----
   C: t_2 = H2(K_c1, K_s1)          S: t_2 = H2(K_c1, K_s1)
   C: z = K_s1^((S_c1 + t_2) / (S_c1 * t_1 + pi))
                                    S: z' = (K_c1 * g^(t_2))^(S_s1)
   (assumption at this point: z = z' if authentication succeeded)

   C: VK_c = H4(K_c1, K_s1, z)      S: VK_c' = H4(K_c1, K_s1, z')
                    ----- VK_c ------->
                                    S: assert(VK_c = VK_c')

   C: VK_s' = H3(K_c1, K_s1, z)     S: VK_s = H3(K_c1, K_s1, z')
                    <----- VK_s ------
   C: assert(VK_s = VK_s')

========

-- 
Yutaka OIWA, Ph.D.                 Leader, System Life-cycle Research Group
                               Research Institute for Secure Systems (RISEC)
     National Institute of Advanced Industrial Science and Technology (AIST)
                       Mail addresses: <[email-masked]>, <[email-masked]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]