Subject: Re: [Cfrg] Cfrg Digest, Vol 90, Issue 2

From: Jonathan Katz <[email-masked]>
Date: Tue, 16 Oct 2012 12:25:56 -0400

The draft hints at some sort of security proof, but does not reference
where one can find such a proof. Is the protocol based on something
published in the literature?

On Mon, Oct 15, 2012 at 3:00 PM, <[email-masked]> wrote:

>
> Today's Topics:
>
>    1. Dragonfly Password Authenticated Key Exchange (Igoe, Kevin M.)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Mon, 15 Oct 2012 17:38:10 +0000
> From: "Igoe, Kevin M." <[email-masked]>
> To: "[email-masked]" <[email-masked]>
> Subject: [Cfrg] Dragonfly Password Authenticated Key Exchange
> Message-ID:
>         <
> [email-masked]>
> Content-Type: text/plain; charset="us-ascii"
>
> I would like to call the list's attention to draft-irtf-cfrg-dragonfly-00,
> recently written
> by Dan Harkins at the request of the CFRG chairs.  Please look it over.
>
> P.S.  We'd welcome suggestions for other algorithms CFRG should take under
> its
> wings.  Our goal is to have a single site people can got to and find
> cryptographic
> primitives either currently being used in the IETF or deemed suitable for
> IETF usage.
>
> The ongoing effort to collect the IETF symmetric key algorithms into a
> single RFC
> is a core part of this effort, but only covers primitives currently in
> use, not primitives
> that the list feels might have a role to play in future IETF standards.
>
>
> ----------------+--------------------------------------------------
> Kevin M. Igoe   | "We can't solve problems by using the same kind
> [email-masked]  | of thinking we used when we created them."
>                 |              - Albert Einstein -
> ----------------+--------------------------------------------------
>
>
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> http://www.irtf.org/mail-archive/web/cfrg/attachments/20121015/6c9e37a3/attachment.htm
> >
>
> ------------------------------
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg
>
>
> End of Cfrg Digest, Vol 90, Issue 2
> ***********************************
>
>

---

From: "Dan Harkins" <[email-masked]>
Date: Tue, 16 Oct 2012 16:54:23 -0700 (PDT)

Hello,

> published in the literature?

  There is no security proof. It can be shown secure against passive
attack but I have no proof against active/dictionary attack.

  In fact, you previously pointed out that in the random oracle model
it probably cannot be proven secure. You showed that if one were to
remove the key confirmation step, have the adversary perform an
active attack against the "commit" exchange and then have the
adversary perform the Reveal query to each side that it would be
possible to do a dictionary attack.

  regards,

  Dan.