Subject: Re: [Cfrg] [CFRG] PAKE selection process: Update on documentation regarding CPace and AuCPace

From: [email-masked]
Date: Fri, 24 Apr 2020 18:48:42 -0500 (CDT)

The section about iterative hash function "IHF" in the CPace draft (https://tools.ietf.org/html/draft-haase-cpace-01) is orphan documentation and should be removed.

The function "IHF" is used inconsistently in the AuCPace draft (https://tools.ietf.org/html/draft-haase-aucpace-01). Sometimes omitting sigma (the work parameters) and in different order than defined.

It's defined as:
IHF(salt, username, pw, sigma)

but used like:
IHF(username,pw,salt)
IHF(pwd,username,salt)
IHF(salt, username, password)
IHF(sigma,username,password, salt)

> On February 7, 2020 at 1:05 PM "Björn Haase" <[email-masked]> wrote:
> 
> 
> Hi CFRG,
> 
> I would like to give notice of the changes in documentation regarding CPace and AuCPace.
>  
> https://tools.ietf.org/html/draft-haase-aucpace-01
> https://tools.ietf.org/html/draft-haase-cpace-01
> 
> Differences in the CPace draft 01: 
> 
> The CPace text is slightly rephrased and now refers to the acronym SDH as the
> simultaneous Diffie-Hellmann problem (as defined and analyzed in the VTBPEKE paper).
> Notation has been modified at some places in order to be in line with a reworked
> paper with the security proof that considers the last recommendations of round 1.
> (To be submitted this week-end).
> 
> Differences in the AuCPace draft 01:
>  
> I have added the process of AuCPace-authenticated transactions, such as useful for
> change-passwords and "sudo"-style transactions. I moreover have fixed a bug in the
> test vector section that stemmed from the fact that some python implementations of
> scrypt seem to have problems with non-ASCII characters in the salt field.
> 
> Moreover, I have setup a repository with reference implementations for SageMath and C.
> Code is available at 
> https://github.com/BjoernMHaase/AuCPace
> 
> Yours,
> 
> Björn.
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

---

From: Björn Haase <[email-masked]>
Date: Sun, 26 Apr 2020 13:06:01 +0200

Thank you for your feedback! I have added a corresponding issue on the
github page where the xml sources for the I-D are maintained.

Yours,

Björn.