1
$\begingroup$

I was looking at Dragonfly key exchange protocol RFC 7664, and it seems to make use of masked Diffie-Hellman in the final part. Generating two random numbers less than group order $q$, $m$, and $r$ and outputting $P^{-m}$ and $m+r$ where $P$ is derived from the password. (I am omitting the analogous ECDH part). I did a little work to see that it is computationally equivalent to CDH, so it is not about basing it on a harder problem.

Is it to protect from some side-channel attacks? If so, what type of side-channel attack is that which works with normal DH but not on Dragonfly? I expect timing attacks on $p$ and $m$ to be equivalent, so I don't think it's about timing attacks on the private exponent. Or is it some side-channel attack targeted towards finding $P$ to facilitate offline dictionary attacks?

As a side note, I don't see any defense from a man-in-the-middle attack by someone who knows the password in the original protocol or has its variants (like WPA3 is using).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.