Subject: [Cfrg] Dragonblood: A Security Analysis of WPA3’s SAE Handshake

From: Tony Arcieri <[email-masked]>
Date: Wed, 10 Apr 2019 13:36:29 -0500

https://papers.mathyvanhoef.com/dragonblood.pdf

Relevant re: some recent CFRG discussions:

“Surprisingly, when the CFRG was reviewing a minor variant of Dragonfly,
they actually discussed these type of modifications [48, 49, 69, 80].
However, to our surprise, this change was not incorporated into any of the
Dragonfly variants.”

-- 
Tony Arcieri

---

From: Björn Haase <[email-masked]>
Date: Wed, 10 Apr 2019 21:56:23 +0200

The final conclusion of Mathy Vanhoef and Eyal Ronen

"Notable is also that nearly all of our attacks are against SAE’s
passwordencoding method, i.e., against its hash-to-group and
hash-to-curvealgorithm. Interestingly, a simple change to this algorithm
wouldhave prevented most of our attacks."

seems to support my belief, that consensus among implementation-oriented
cryptographers probably should be easy to be established with respect to
the significant problems of the hash-to-curve algorithm as used in
dragonfly (which does not execute in constant time).

Specifically as a responsible citizen and employee, I'd would not
consider dragonfly for new standards or products/development projects.
Especially  since other efficient choices for balanced PAKE are
available, notably SPAKE2, CPace and TBPEKE.  Note that all of the
latter protocols avoid the non-constant-time hash2curve algorithm and
have moreover been analyzed also with respect to forward secrecy.

Regarding the security analysis of PAKE protocols, I'd like to draw the
attention to the recent paper of /Jose Becerra and Dimiter Ostrev and
Marjan Skrobot in https://eprint.iacr.org/2019/351/which have presented
a security proof regarding forward-secrecy of the balanced PAKE protocol
SPAKE2.

Yours,
Björn

Am 10.04.2019 um 20:36 schrieb Tony Arcieri:
> “Surprisingly, when the CFRG was reviewing a minor variant of
> Dragonfly, they actually discussed these type of modifications [48,
> 49, 69, 80]. However, to our surprise, this change was not
> incorporated into any of the Dragonfly variants..”
>
> --
> Tony Arcieri
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

---

From: Tony Arcieri <[email-masked]>
Date: Wed, 10 Apr 2019 15:07:40 -0500

After searching through email, I found Kenny’s original response about the
Dragonfly RFC publication process which sheds some light on what changes
would’ve been desirable. Seems IPR was a concern:

https://mailarchive.ietf.org/arch/msg/cfrg/-QH50u3EdTkoVQebWKjcN5ekKYw

-- 
Tony Arcieri