Subject: [Cfrg] Forward secrecy of SPAKE2

From: Watson Ladd <[email-masked]>
Date: Wed, 4 Sep 2019 13:34:01 -0700

Dear all,

I overlooked https://eprint.iacr.org/2019/351.pdf in my earlier
discussions of SPAKE2.

Sincerely,
Watson

---

From: Björn Haase <[email-masked]>
Date: Wed, 4 Sep 2019 22:48:15 +0200

Dear Watson,

 >I overlooked https://eprint.iacr.org/2019/351.pdf in my

>earlier discussions of SPAKE2.

Yes. You might also have overlooked my post from July 19th :-).

https://mailarchive.ietf.org/arch/msg/cfrg/28La-UQyKqpDyaLeIZ_ikD5ccoY

Yours, Björn

---

From: Wasa Bee <[email-masked]>
Date: Mon, 9 Sep 2019 09:27:21 -0700

Hi

AFAIK, PFS has two components (I recall a presentation by Hugo Krawczyk but
I don't remember which conference):
- long term key compromise does not break the security of past
communications.
That's what the paper shows (long-term key = password)
- short term key compromise (eg ephemeral DH private key, session key) does
not break the security of future sessions. I don't think this holds for
PFS-SPAKE2, i.e., an attacker who recovers the DL of the public DH share
can recover the password, and impersonate the participants thereafter:

1) -> Imagine an attacker sends X* = g^x (instead of the intended X* =
g^x.M^p, since he does not know the password p).
2) <- The victim Bob computes (X*/M^p)^y = g^xy / M^yp = K, and sends Y* =
g^y - Note this is different from the original SPAKE2 where Bob sends
g^y.N^p. Bob also sends the confirmation message H1(C, S, X∗, Y, K, p).

If the attacker subsequently manages to recover the ephemeral exponent y
for Y*, then he can offline brute force the password p, by trying all
(low-entropy) passwords p_guess such that:
H1 = H1_guess(C, S, X*, Y, g^xy/M^yp_guess, p_guess)
C, S, X* and Y are publicly available
x is generated by attacker so is known to him
y is known as per assumption
=> only unknown is p

The attacker now knows the password and can impersonate as Alice or Bob.
Note this works because password have low entropy.

Note that for the original SPAKE2, if y leaks, then there is a similar
problem. However in the original SPAKE2 protocol, g^y in never transmitted.
What's transmitted instead is g^y.N^p (by Bob, phase 2 above), so I don't
think the attacker can recover y since he does not even sees g^y - at least
it seems more difficult. So to me SPAKE2 can withstand a stronger attacker
model in this scenario: an attacker must break into Bob's computer and
recover his volatile memory to get y. At this point's it's probably easier
for the adversary to recover p itself so this is an acceptable scenario,
IMHO...

Did I miss something?

Any thoughts?

On Wed, Sep 4, 2019 at 1:48 PM Björn Haase <[email-masked]> wrote:

> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>