Subject: Re: [TLS] Remarks on draft-shin-tls-augpake-01

From: SeongHan Shin <[email-masked]>
Date: Tue, 4 Feb 2014 18:23:16 +0900

Hi Watson,

Thank you for your comments!
A simple way to make AugPAKE to be group agnostic is to convert AugPAKE to
balanced one.
Of course, I need to think about other ways.

A description of AugPAKE over ec groups would be added after the 89th
meeting.

Best regards,
Shin

On Wed, Jan 8, 2014 at 3:11 AM, Watson Ladd <[email-masked]> wrote:

> Given that Dragonfly refuses to die, I think it is worth considering
> AugPAKE. I've changed my mind about the necessity: the IoT people want
> it badly, and if we don't do this, it will be Dragonfly.
>
> The only issue I see is the draft needs to be made group agnostic and
> work on some sufficiently big ECC group. That's a straightforward, if
> tedious, change of notation.
>
> Sincerely,
> Watson Ladd
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
------------------------------------------------------------------
SeongHan Shin
Research Institute for Secure Systems (RISEC),
National Institute of Advanced Industrial Science and Technology (AIST),
Central 2, 1-1-1, Umezono, Tsukuba City, Ibaraki 305-8568 Japan
Tel : +81-29-861-2670/5284
Fax : +81-29-861-5285
E-mail : [email-masked]
------------------------------------------------------------------

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 4 Feb 2014 14:50:02 +0200

> Of course, I need to think about other ways.

I think Watson meant generalizing AugPAKE over arbitrary group with
appropriate hardness properties. Especially elliptic-curve ones.

I see nothing that wouldn't map in straightforward manner into elliptic
curves and only bn2bin(X) that wouldn't map in straightforward manner
to completely arbitrary group.

As for the -1, 0, 1 check, that can be replaced with check that:
a) The element is valid (e.g. nonzero or satisfies curve equation) AND
b) The order of element has prime factor of at least q

Those checks are quite cheap with most actually used elliptic curves.

Also, some misc feedback:
- What's the endian of bn2bin(X)? Big endian?
- How are X and Y encoded on the wire? bn2bin?
- Maybe expand on consequences of terminating on invalid username
  (allowing probing of valid usernames)?

-Ilari

---

From: SeongHan Shin <[email-masked]>
Date: Wed, 5 Feb 2014 15:32:47 +0900

Hi llari,

Thank you for your clarity and feedbacks.

>- How are X and Y encoded on the wire? bn2bin?
The draft does not specify the above points because these depend on
implementations.

>- Maybe expand on consequences of terminating on invalid username
I think the current check on authenticators is fine.

>  (allowing probing of valid usernames)?
An orthodox way is to use DHE for encrypting usernames.
This will be added in "Security Considerations" section.

Best regards,
Shin

On Tue, Feb 4, 2014 at 9:50 PM, Ilari Liusvaara <[email-masked]
> wrote: