Subject: [Cfrg] [CFRG] PAKE: Draft for AuCPace available // Feedback appreciated regarding legacy-database migration to PAKE for servers

From: Björn Haase <[email-masked]>
Date: Mon, 13 Jan 2020 10:54:20 +0000

Dear CFRG community,

I have just posted a first version of an RFC-style draft also regarding the augmented protocol  AuCPace.

Augmented:
https://datatracker.ietf.org/doc/draft-haase-aucpace/
Balanced:
https://datatracker.ietf.org/doc/draft-haase-cpace/

Any feedback would be appreciated!

The draft as it is written now is meant to serve mainly as basis for a in depth security analysis. Specifically, I have also included the complexity of the
user-credential database interface that was not detailed in the AuCPace paper.

Specifically, I have pointed out, why “strong” pake protocols won’t allow for such a migration. Correspondingly the specification in the draft supports both, strong and conventional PAKE.

I believe that for applications that today work with established large user-credential databases, a smooth migration to a PAKE-Approach might be highly relevant, e.g. for applications with a large existing customer base, such as e.g. Facebook.

I think that this aspect might worth being discussed in more detail: Is migration of a legacy-style user-credential database on a server to a PAKE-suitable format an important use-case or not.

Yours,

Björn.

Mit freundlichen Grüßen I Best Regards 

Dr. Björn Haase 

Senior Expert Electronics | TGREH Electronics Hardware
Endress+Hauser Conducta GmbH+Co.KG | Dieselstrasse 24 | 70839 Gerlingen | Germany
Phone: +49 7156 209 377 | Fax: +49 7156 209 221
[email-masked] |  www.conducta.endress.com 

Endress+Hauser Conducta GmbH+Co.KG
Amtsgericht Stuttgart HRA 201908
Sitz der Gesellschaft: Gerlingen
Persönlich haftende Gesellschafterin:
Endress+Hauser Conducta Verwaltungsgesellschaft mbH
Sitz der Gesellschaft: Gerlingen
Amtsgericht Stuttgart HRA 201929
Geschäftsführer: Dr. Manfred Jagiella

Gemäss Datenschutzgrundverordnung sind wir verpflichtet, Sie zu informieren, wenn wir personenbezogene Daten von Ihnen erheben.
Dieser Informationspflicht kommen wir mit folgendem Datenschutzhinweis (https://www.endress.com/de/cookies-endress+hauser-website) nach.

Disclaimer: 

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you receive this in error, please contact the sender and delete the material from any computer. This e-mail does not constitute a contract offer, a contract amendment, or an acceptance of a contract offer unless explicitly and conspicuously designated or stated as such.