I want Alice to symmetrically encrypt a large file, transmit it over a public network and have Bob decrypt it. The shared secret of the two is a password, potentially very simple and may be reused often. The password is shared offline, potentially insecurely (by Alice shouting it across the room or whispering it into Bob's ears or even being a preshared key like Alice asking "the same password as always?"). I am envisioning an AES-CTR + HMAC-SHA256 + SPAKE2 implementation.

The way I understand the perfect forward secrecy PAKE gives me (by not sharing its internal state but only a derived state) means that even if an eavesdropper could listen to both

  • Alice shouting the password to Bob
  • Intercepting the entire transmission

they would not be able to find the exchanged key and thus be able to decipher the message. Is that correct?

The way I understand it, the only situation in which a third party could successfully interfere is after Alice shouted the password but before Bobs SPAKE2 message reached Alice. Is that correct?


closed as off-topic by e-sushi Dec 31 '16 at 0:07

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    $\begingroup$ I have reworded the question to hopefully be more on-topic $\endgroup$ – Nils Werner Dec 31 '16 at 0:55
  • $\begingroup$ If Bob's SPAKE2 message reaches Alice before Alice's SPAKE2 message reaches Bob, then a third party could successfully interfere between those two events. ​ ​ $\endgroup$ – user991 Dec 31 '16 at 4:35
  • $\begingroup$ @RickyDemer but then the third party could only cause Bob to read garbage, but won't be able to decipher the message, right? $\endgroup$ – Nils Werner Dec 31 '16 at 8:52
  • $\begingroup$ My comment was assuming the third party knows the password before it sends whatever to Bob, since your question's last paragraph seemed to assume that. ​ ​ $\endgroup$ – user991 Dec 31 '16 at 8:55
  • $\begingroup$ Yes, the third party knows the password. $\endgroup$ – Nils Werner Dec 31 '16 at 9:01

Browse other questions tagged or ask your own question.