[curves] Use cases for PAKE?

[Trevor Perrin]

On Thu, Mar 20, 2014 at 3:23 AM, Feng Hao <feng.hao at newcastle.ac.uk> wrote:

>
>
>  * PAKE for the web has been attempted in TLS (RFC 5054) with little
> interest from browsers or sites.  Partly this is a layering problem
> (username in clear, too early in the connection, and the TLS terminator is
> the wrong place for client auth).  But there are deeper UI problems:
>  browsers would have to display an unspoofable dialog; users would have to
> be trained to enter certain passwords only into this dialog; and sites
> would lose control of login UI.  Client auth for the web seems likely to
> evolve in other directions (e.g. password managers, 2-factor, federation).
>
>
>
> The web UI is indeed a major issue. It should be possible for the web
> browser to add a trusted UI for entering passwords (e.g., possibly in the
> address bar next to the web address where you click to find out the
> certificate details). But still, the question is how to educate ordinary
> users to *only* use this trusted interface for password entry. If a
> phishing website displays a password field in the web page and asks users
> to enter the password, then the PAKE mechanism is entirely bypassed and
> becomes useless.
>

Yeah, because of these difficulties browsers don't seem interested:

http://www.ietf.org/mail-archive/web/tls/current/msg11586.html


  * SSH already has J-PAKE which (I think?) is rarely used, though I'm not
> sure why.  If part of the reason is performance, is there room for
> improvement here?
>
>
>
> I don't think performance is any issue. I guess the main concern may be
> that J-PAKE has not been formally standardized. I submitted an initial
> proposal (
> http://homepages.cs.ncl.ac.uk/feng.hao/files/RationaleForJPAKE.pdf) to
> the UK standards committee meeting last month in Feb, and it passed the
> preliminary review; next month, I'm going to present J-PAKE, as the UK
> input, to ISO/IEC at the international SC27 meeting (http://www.sc27.hk/).
>

Hmm.  It seems J-PAKE wasn't compiled into OpenSSH by default, and was
removed entirely ~2 months ago?

http://comments.gmane.org/gmane.os.openbsd.cvs/127043

I believe OpenSSH has made curve25519 their default key exchange, so they
seem willing to support crypto that isn't blessed by "official" standards.
 I'd be surprised if approval by "ISO/IEC 11770-4" (which I'd never heard
of) makes a difference.

http://www.libssh.org/2013/11/03/openssh-introduces-curve25519-sha256libssh-org-key-exchange/

Perhaps PAKE isn't desirable for SSH?  If anyone knows the right people to
ask at OpenSSH, I'd like to know their thinking.



>   * IEEE 802.11s I think has standardized on "Simultaneous Authentication
> of Equals" (aka Dragonfly) as an EC PAKE. I don't know if it's seen real
> deployment, nor do I understand the "mesh networking" scenario it's being
> used for, which seems different from just authenticating a client to an AP.
>  Anyone know more?
>
>
>
> I don't think the EC version of Dragonfly is fully specified. It is
> derived from SPEKE, and has the same issues as SPEKE when it comes to both
> DL and EC implementations (the file in the above link gives a bit more
> details).
>

Are you claiming that EC-Dragonfly in 802.11s is not "fully specified"?

I just downloaded 802.11s ($260!).  It seems to fully describe Dragonfly
over "FFC" and "ECC" groups.  In fact, NIST P-256 is the
mandatory-to-implement group.

http://standards.ieee.org/findstds/standard/802.11s-2011.html

What I don't know is how much deployment this is seeing?


Anyways, it's not clear that there are strong-enough use cases to motivate
> a good discussion and keep it on track.  Though I wish there were!  PAKEs
> are cool, it seems like they should be useful somewhere.
>
>
>
> I believe there are useful use cases in certain applications. Currently,
> I'm supervising an undergraduate student project. The student is developing
> a secure messaging app for Android. The app establishes a secure E2E
> communication channel with another Android phone user via a google cloud
> after both users enter the same short code at two phones. The encryption is
> end-to-end, so no third parties, including Google, ISP etc, are able to
> eavesdrop. The app is based on J-PAKE (using the existing boucycastle
> implementation). We plan to release the app for free when the project is
> done, possibly, in the next 2-3 months.
>

[You also wrote, later]:
"""
They may speak over the phone: hey, do you still remember the day when we
went to see that scary movie together? Let's use that date as the password
to start secure chatting now so no one will know what we are talking about.
"""

OK, so this is basically the OTR / Socialist Millionaire's case:

http://www.cypherpunks.ca/~iang/pubs/impauth.pdf

I don't know whether that's been a good user experience or not, perhaps
that's a question for the "messaging" list...


Trevor
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://moderncrypto.org/mail-archive/curves/attachments/20140321/ac5fb754/attachment.html>