I was looking at Dragonfly key exchange protocol RFC 7664, and it seems to make use of masked Diffie-Hellman in the final part. Generating two random numbers less than group order $q$, $m$, and $r$ and outputting $P^{-m}$ and $m+r$ where $P$ is derived from the password. (I am omitting the analogous ECDH part). I did a little work to see that it is computationally equivalent to CDH, so it is not about basing it on a harder problem.

Is it to protect from some side-channel attacks? If so, what type of side-channel attack is that which works with normal DH but not on Dragonfly? I expect timing attacks on $p$ and $m$ to be equivalent, so I don't think it's about timing attacks on the private exponent. Or is it some side-channel attack targeted towards finding $P$ to facilitate offline dictionary attacks?

As a side note, I don't see any defense from a man-in-the-middle attack by someone who knows the password in the original protocol or has its variants (like WPA3 is using).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.