2
$\begingroup$

The introduction to SPAKE pre-authentication states:

Diffie-Hellman Encrypted Key Exchange (DH-EKE) is the earliest widely deployed PAKE. It works by encrypting the public keys of a Diffie-Hellman key exchange with a shared secret. However, it requires both that unauthenticated encryption be used and that the public keys be indistinguishable from random data. This last requirement makes it impossible to use this form of PAKE with elliptic curve cryptography. For these reasons, DH-EKE is not a good fit.

I'm curious about the sentence in bold--why does DH-EKE require that the public keys be indistinguishable from random data? After all, the public keys are public, and furthermore, they will be encrypted with the shared password.

I'm guessing that if the public keys are in fact distinguishable from random data, that that reveals some information about the shared password, but I don't know how.

Improve this question
$\endgroup$
1
  • $\begingroup$ "This last requirement makes it impossible to use this form of PAKE with elliptic curve cryptography."; actually, that's not true; it's just the simple 'do a keyed permutation on the bitstring representing the public key' doesn't work... $\endgroup$
    – poncho
    Commented Dec 4, 2018 at 2:31

1 Answer 1

Reset to default
1
$\begingroup$

In DH-EKE, Alice needs to encrypt her chosen public key with the shared password. If the public keys do not look random, an attacker can try to decrypt Alice's first encrypted message to recover a small set of possible passwords, merely by checking if the decrypted message belongs to the public key space or not. Note that this is an offline attack, which is the type of attacks that PAKE protocols aim to prevent.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.