Timeline for Is there any SRP-like key exchange only using "standard" cryptographic primitives?
Current License: CC BY-SA 3.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 9, 2017 at 15:27 | history | bounty ended | ithisa | ||
| Mar 9, 2017 at 15:27 | history | edited | Geoffroy Couteau | CC BY-SA 3.0 |
typos
|
| Mar 9, 2017 at 15:26 | vote | accept | ithisa | ||
| Mar 8, 2017 at 20:05 | comment | added | Geoffroy Couteau | @user54609: I edited my answer, you might want to check it. | |
| Mar 8, 2017 at 20:04 | history | edited | Geoffroy Couteau | CC BY-SA 3.0 |
added 649 characters in body
|
| Mar 7, 2017 at 9:53 | comment | added | Geoffroy Couteau | I have been thinking again about your question, and have some potential ideas that might (or might not) lead to a solution. But first, would you be fine with the minimal requirement of having to know the order of the group? You would not have to know the group structure, nor how group elements are encoded or how they can be multiplied, only the order of the group. | |
| Mar 5, 2017 at 18:05 | comment | added | Geoffroy Couteau | I understand. I will take some time to think about your constraints, trying to see if I can figure out something. | |
| Mar 5, 2017 at 17:12 | comment | added | ithisa | Unfortunately this requirement makes it unsuitable for my case. I would like to use, say, elliptic-curve DH to implement it, without even knowing what an elliptic-curve is mathematically. | |
| Mar 5, 2017 at 15:18 | history | edited | Geoffroy Couteau | CC BY-SA 3.0 |
Added corrections
|
| Mar 5, 2017 at 14:50 | comment | added | Geoffroy Couteau | Let us continue this discussion in chat. | |
| Mar 5, 2017 at 14:49 | comment | added | Geoffroy Couteau | Me neither, let's discuss that directly in the Side Channel chatroom? | |
| Mar 5, 2017 at 14:49 | comment | added | user991 | I have time, but don't know how to create a chatroom here. | |
| Mar 5, 2017 at 14:37 | comment | added | Geoffroy Couteau | I'm not sure I'm following you, can we discuss that in a chat, if you have a few minutes? | |
| Mar 5, 2017 at 14:30 | comment | added | user991 | That does not necessarily work - Suppose the group elements all start with security parameter zeros. | |
| Mar 5, 2017 at 14:26 | comment | added | Geoffroy Couteau | Well, depends if you see the protocol as a complete black box that only provides a common key, or as some pre-existing code that will generate the message of Alice for Alice, the message of Bob for Bob, and will then give the corresponding key. Here, you can simply take the message generated for the DH key exchange, and encrypt it to get your message of the PAKE. | |
| Mar 5, 2017 at 13:54 | comment | added | user991 | "any Diffie-Hellman key exchanged" is not enough - One also needs oblivious sampling of group elements, or something very close to that. | |
| Mar 5, 2017 at 13:36 | history | edited | Geoffroy Couteau | CC BY-SA 3.0 |
edited body
|
| Mar 5, 2017 at 9:53 | history | answered | Geoffroy Couteau | CC BY-SA 3.0 |