Subject: [Cfrg] ASK: Secret Handshakes From Pairing-based Key Agreements

From: Dave Thaler <[email-masked]>
Date: Sun, 13 Nov 2016 22:55:49 +0000

Hi CFRG folks,

In the security considerations section of draft-thaler-core-redirect-01, I wrote (below) of an auth mechanism
gap we have today.  Although the first need though is for DTLS with coap, this gap isn't specific to the core WG, 
it's applicable to any peer-to-peer-style communication where both endpoints are concerned about privacy.

>   Preventing identifying information from being observed by untrusted
>   clients doing multicast discovery is necessary but not sufficient to
>   mitigate the privacy issues discussed in Section 1.  That is, one
>   must also use an authentication scheme for subsequent unicast
>   messages that does not reveal a stable identifier to clients before
>   authentication is complete.  Mutual authentication schemes exist
>   (e.g., [Balfanz]) that only reveal the identity of both endpoints if
>   authentication succeeds, but they may not yet be available in current
>   standards and popular code bases.

And the reference is from SOSP 2003:
>   [Balfanz]  Balfanz, D., Durfee, G., Shankar, N., Smetters, D.,
>              Staddon, J., and H-C. Wong, "Secret Handshakes From
>              Pairing-based Key Agreements", May 2003,
>              <http://ieeexplore.ieee.org/document/1199336>.

This is a real-world problem and at least one other SDO (OCF) wants to implement a solution in the near
future, and I will be mentioning this gap in the CoRE WG.   Since there's been existence proofs of
solutions since 2003, it seems a solution could be ready for engineering if CFRG can analyze/recommend
a specific mechanism in this category, whether it's the Balfanz mechanism or some other derivative
or variation.  

Is this something that some CFRG people can do?

Dave