<div dir="ltr">Trevor,<div><br></div><div>It's probably not very interesting, but I'm finishing ongoing work on combining Physical Unclonable Functions (if they exist) with PAKEs for token-based multifactor transaction authentication in banking applications.</div>
<div><br></div><div>Best,</div><div class="gmail_extra"><div><div dir="ltr">--<br>Diego de Freitas Aranha<br>Institute of Computing - University of Campinas<br><a href="http://www.ic.unicamp.br/~dfaranha" target="_blank">http://www.ic.unicamp.br/~dfaranha</a></div>
</div>
<br><br><div class="gmail_quote">On Wed, Mar 19, 2014 at 8:17 PM, Trevor Perrin <span dir="ltr"><<a href="mailto:trevp@trevp.net" target="_blank">trevp@trevp.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><br><div class="gmail_extra"><div class="gmail_quote"><div>On Wed, Mar 19, 2014 at 11:44 AM, Arlo Breault <span dir="ltr"><<a href="mailto:arlolra@gmail.com" target="_blank">arlolra@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">PANDA's an interesting use case for EKE2.<div>
<br></div><div><a href="https://pond.imperialviolet.org/tech.html" target="_blank">https://pond.imperialviolet.org/tech.html</a><br></div><div><a href="https://github.com/agl/pond/blob/master/papers/panda/panda.tex" target="_blank">https://github.com/agl/pond/blob/master/papers/panda/panda.tex</a></div>
</div></blockquote><div><br></div><div><br></div></div><div><div>Hi Arlo,</div><div><br></div><div>There was some discussion of Pond's "PANDA", and its PAKE, here:</div><div><br></div><div><a href="https://moderncrypto.org/mail-archive/messaging/2014/000086.html" target="_blank">https://moderncrypto.org/mail-archive/messaging/2014/000086.html</a></div>
<div><br></div><div>It's true that it uses a rough form of "EKE2" (aka the Bellare/Pointcheval/Rogaway formalization of what Bellovin/Merritt called "DH-EKE" [1,2]).</div><div><br></div><div>But I don't think the PAKE provides value, since the "meeting ID" undermines it and enables guessing against the meeting secret (which the PAKE is also based on).</div>
<div><br></div><div>My impression is that PAKE is there in the hope that the meetingID problem would one day be solved. But until that happens, this doesn't seem like a great use case.</div><div><br></div><div><br></div>
<div>Trevor</div><div><br></div><div><br></div><div>[1] <a href="http://eprint.iacr.org/2000/014.pdf" target="_blank">http://eprint.iacr.org/2000/014.pdf</a></div><div>[2] <a href="http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.45.3156" target="_blank">http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.45.3156</a></div>
</div><div><br></div></div></div></div>
<br>_______________________________________________<br>
Curves mailing list<br>
<a href="mailto:Curves@moderncrypto.org" target="_blank">Curves@moderncrypto.org</a><br>
<a href="https://moderncrypto.org/mailman/listinfo/curves" target="_blank">https://moderncrypto.org/mailman/listinfo/curves</a><br>
<br></blockquote></div><br></div></div>