Skip to main content
8 votes
Accepted

How does Dragonfly key exchange work, in non-white-paper terms?

Dragonfly is resistant to dictionary attacks, meaning that rather than an attacker being able to identify the use of a password in their dictionary with passive computation, they are forced to ...
poncho's user avatar
  • 148k
6 votes
Accepted

"Oblivious" Argon2id? (or comparable KDF/KSF)?

For a scenario such as PAKE with a low-powered client and a high-powered server, Makwa offers a delegation feature, where the server performs the stretching part of the calculation. The server does ...
Gilles 'SO- stop being evil''s user avatar
6 votes
Accepted

What are the practical differences between SCRAM and PAKE (OPAQUE) for simple authentication?

The goal of SCRAM is to determine whether the two endpoints share a common secret. SCRAM achieves this by having both parties compare/exchange $\textrm{HMAC}(s,i)$ where $s$ is the secret and $i$ is a ...
Mikero's user avatar
  • 13.5k
6 votes

Designing of Password Authenticated Key Exchange (PAKE) Schemes?

The definition of PAKE just suggests that one or more parties are exchanging keys with knowledge of a shared password that authenticates the exchanged key. There are definitely use-cases of PAKEs that ...
kkl's user avatar
  • 383
5 votes

Why are PAKE protocols not widely used?

I see three main reasons why PAKEs are not widely used yet: The lack of IETF standards. SRP has limitations discussed in the link @fgrieu posted above. Many PAKE protocols have been designed, but ...
Frank Denis's user avatar
  • 2,973
5 votes
Accepted

Secure password-authenticated key exchange that allows for passwords to be stored as hashes, but does not make the hashes password-equivalent

Are there any secure password-authenticated key exchange that allows for passwords to be stored as hashes, but does not make the hashes password-equivalent? Yes, they are called augmented or ...
SEJPM's user avatar
  • 46.1k
5 votes
Accepted

Why would the use of Curve25519 in Dragonfly leak information?

In the Dragonfly protocol on an elliptic curve, the password is mapped to a point $P$, and then both sides exchange (among other things) the values $-mP, -m'P$. If the elliptic curve has a composite ...
poncho's user avatar
  • 148k
5 votes
Accepted

What's going on with the complicated implementations for map_to_curve in draft-irtf-cfrg-hash-to-curve?

It seems to me that it should be simple enough to map an integer/field element $u$ to a curve point by just using $uG$ with $G$ being the generator for the curve. That is indeed simple; however using ...
poncho's user avatar
  • 148k
4 votes
Accepted

Is PAKE more secure than WPA2?

An attacker who was able to sniff the initial exchange could perform an offline dictionary attack on the AP password. That is indeed correct for WPA2 why don't WIFI security protocols use PAKE? I ...
poncho's user avatar
  • 148k
4 votes

Is there a PAKE algorithm that is fully resistant to a server data leak?

The server's data is public That assumption makes the idea of a PAKE undoable. If the attacker has access to all the server's data, here's what he can do: clone the server, place the clone in his ...
poncho's user avatar
  • 148k
4 votes
Accepted

Provably Secure Password Authenticated Key Exchange Based on RLWE for the Post-QuantumWorld

A password authenticated key exchange (PAKE) scheme assumes that the two parties have some shared secret (the password) with too little entropy. They now want to agree on a key and authenticate each ...
Elias's user avatar
  • 4,923
4 votes
Accepted

Can the TLS 1.3 PSK-DHE handshake be turned into a PAKE?

The current TLS 1.3 draft proposal with PSK does not have PAKE properties; in particular, a client can send a single message, get a reply, and then check every entry in his dictionary to search for ...
poncho's user avatar
  • 148k
4 votes
Accepted

On the security definition of password-authenticated key exchange

Let's approach the question from this direction. PAKE tries to solve this problem: Alice has a password $PW_{a}$, and Bob has a password $PW_{b}$; consider a protocol where Alice and Bob exchange ...
poncho's user avatar
  • 148k
3 votes

An efficient SPEKE protocol with curve25519

One small issue is that it can be detected if the x-coordinate lives on the base curve or on its twist. There's not a small issue; this allows a passive attacker to halve his dictionary by listening ...
poncho's user avatar
  • 148k
3 votes
Accepted

Should I assume that all exponent syntax in the description of a Diffie-Hellman-based protocol implies modding?

but does the use of a modulus or are the exponents literally meant to be exponents alone? Well, in SPAKE2+, all operations are done within some finite group, typically either a prime multiplicative ...
poncho's user avatar
  • 148k
3 votes
Accepted

Simply using password as a third "private key" for PAKE

Here's the problem with this scheme: suppose $A$ is the honest client, and $B$ is a dishonest server (who doesn't know $s$). Then, $A$ tries to log in, he selects $a$ and transmits $$A = g^{as} \...
poncho's user avatar
  • 148k
3 votes

PAKE password change

If you use an augmented PAKE (such as AuCPace or Opaque), the server never gets a copy of the password in the first place. Hence, to update the password, you would reregister with the new password, ...
poncho's user avatar
  • 148k
3 votes
Accepted

Do all PAKE assume that all parties already have a password?

Do PAKE assumes that involved parties already have a shared message? Some do, some don't. In general, there are two flavors of PAKEs; balanced (where both sides do know the password), and ...
poncho's user avatar
  • 148k
3 votes
Accepted

Is the following PAKE protocol UC secure?

You're right that it's not UC-secure, for exactly the reason you say. It allows offline dictionary attacks. Here's how that problem manifests in the UC model: Consider this particular environment: ...
Mikero's user avatar
  • 13.5k
3 votes
Accepted

Have any PAKE extensions been added to TLS 1.3?

Has anything been done since then to add PAKE support to TLS 1.3? Are there any active proposals? No, nothing has been done, and there are no active drafts. One possible reason for this (I don't know ...
poncho's user avatar
  • 148k
2 votes

What's going on with the complicated implementations for map_to_curve in draft-irtf-cfrg-hash-to-curve?

Its mandatory to use a map such as elligator for the generator. Otherwise offline attacks are easy. Just using the u coordinate as generator will leak 1 bit of the password per protocol execution, ...
Björn haase's user avatar
2 votes

Could PAKE via smooth projective hash function protect agaist replay attacks?

And I checked some related works, and most of them only considered the dictionary attack and forward security. Actually, a PAKE has two security goals: That someone cannot recover the password from ...
poncho's user avatar
  • 148k
2 votes
Accepted

Does FIPS have any PAKE algorithms?

Are there any password-authenticated key exchange (PAKE) algorithms in FIPS standards? Not formally, no. On the other hand, you could cobble together, say, EKE from DH and FPE (both of which has ...
poncho's user avatar
  • 148k
1 vote

Anonymous PAKE using two party computation

So, does anyone knows of any work about this or is doing anything which can achieve this more efficiently in constant or at least sublinear time of number of clients to be practical. Well, with your ...
poncho's user avatar
  • 148k
1 vote

Why does the PAKE ideal functionallity allow the keys to be the same when the passwords differ?

The paper contains text that explains why this is OK. I quote: The main idea behind the FKE functionality is as follows: If both participating parties are not corrupted, then they receive the same ...
Yehuda Lindell's user avatar
1 vote
Accepted

Questions on PRF

Is there any formal proof that they are PRFs? In these applications (PSI, PAKE), it's usually not necessary to prove standalone PRF security. Sometimes you can get a secure PSI for example from ...
Mikero's user avatar
  • 13.5k
1 vote

Have any PAKE extensions been added to TLS 1.3?

Since posting the question, I became aware of TLS-PWD, defined in RFC 8492, which uses the Dragonfly PAKE (RFC 7664) and does define support for both pre-1.3 TLS and TLS 1.3. I'm currently (as of Jan ...
reirab's user avatar
  • 175
1 vote
Accepted

What is the definition of dummy password?

It appears this term is only used in the proof. In this context "dummy password" is to be understood as "some value that syntactically fits the requirements of a regular password including matching ...
SEJPM's user avatar
  • 46.1k
1 vote

What are the major advantages of SPHF for PAKE?

SPHF are a very versatile tool, and they have a large number of applications. Their application to PAKE stems from three main properties: first, they allow for low-interactivity PAKE. Note that this ...
Geoffroy Couteau's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible