Subject: Re: SRP unencumbered license statement

From: Tom Holroyd <[email-masked]>
Date: Tue, 1 May 2001 16:54:00 +0900 (JST)

On Sun, 29 Apr 2001, RJ Atkinson wrote:
> At 06:26 27/04/01, Tom Wu wrote:
> >For those of you who were following the discussion about the new draft
> >and implementation of SRP-based password authentication in OpenSSH, I
> >promised to have Stanford issue the IETF an official, explicit,
> >statement reiterating the unencumbered royalty-free licensing terms.
> >The new statement is now available from the IETF's IPR page.
>
> Thanks.
>
> For those who are having trouble finding the URL:
>         http://www.ietf.org/ietf/IPR/WU-SRP
>
> Note that there are specific limits to the Stanford grant of rights,
> so I'd ask that we try to stay within the "no payment needed"
> portion of SRP if SRP is adopted...

Stanford University is granting a royalty-free license for RFC 2945
implementations -- and the OpenSSH SRP implementation is of that sort.
That is, not only are we free and clear, but the algorithm is safe from
future claimjumpers trying to patent it.

Not to mention that it provides strong authentication of both client *and*
server, even when the host key has changed or is unknown, and it doesn't
leak any information to eavesdroppers or MITM.  :-)

So, SRP is ready to go.

Speaking of which, an up-to-date tarball and patch are available:

http://members.tripod.com/professor_tom/archives/OpenSSH-2.9p1-srp7.tar.gz
http://members.tripod.com/professor_tom/archives/OpenSSH-2.9p1-srp7.patch.gz

The patch is vs. the 20010501 CVS, the tarball is self-contained (remember
to left-click on those links to download the files from Tripod).  See the
README.SRP file for more info and installation instructions.

Here is the signature of the tarball (OpenSSH-2.9p1-srp7.tar)
and here is the signature of the patch (OpenSSH-2.9p1-srp7.patch)

My GPG public key is available from standard keyservers.

Dr. Tom Holroyd
"I am, as I said, inspired by the biological phenomena in which
chemical forces are used in repetitious fashion to produce all
kinds of weird effects (one of which is the author)."
	-- Richard Feynman, _There's Plenty of Room at the Bottom_

---

From: Mika Kojo <[email-masked]>
Date: Tue, 1 May 2001 14:49:38 +0300

> leak any information to eavesdroppers or MITM.  :-)

The problem with SRP, when compared to some other password-AKE's, is
that it doesn't provide a security proof in the standard
models. Security proof would guarantee that negligible information
leakage occurs when adversary is not capable of solving the decisional
Diffie-Hellman problem or some such. If you have such a proof please
supply a reference.

Best regards,
Mika Kojo
SSH Communications Security Corp

---

From: RJ Atkinson <[email-masked]>
Date: Tue, 01 May 2001 09:17:41 -0400

At 03:54 01/05/01, Tom Holroyd wrote:

>That is, not only are we free and clear, but the algorithm is safe from future claimjumpers trying to patent it.
>
>Not to mention that it provides strong authentication of both client *and* server, even when the host key has changed or is unknown, 
>and it doesn't leak any information to eavesdroppers or MITM.  :-)

        The Stanford IPR release to IETF is clear and says that 
bi-directional authentication mode (SRP-Z) requires a  
separate licence, and is not free.  Only implicit server
authentication mode is free.

        Your statement above appears at variance with the actual
words from Stanford.  I'd encourage folks to go read the actual
words from Stanford, not anyone's interpretations of them.

Ran
[email-masked]

---

From: Tom Wu <[email-masked]>
Date: Tue, 01 May 2001 11:40:27 -0700

> authentication mode is free.

Tom H's code does implicit server authentication.  It's free and clear. 
For the record, Niels M's code is also based on implicit server
authentication.

Tom
-- 
Tom Wu
Principal Software Engineer
Arcot Systems
(408) 969-6124
"The Borg?  Sounds Swedish..."

---

From: Tom Wu <[email-masked]>
Date: Tue, 01 May 2001 11:43:01 -0700

> Diffie-Hellman problem or some such. If you have such a proof please

The only other password-based key exchange that has a security proof (in
the random oracle model) is PAK, and it's not free to my knowledge.  The
majority of the secure password protocols (EKE, SPEKE, etc.) fall into
the "unproven but unbroken" category.

Tom

---

From: Mika Kojo <[email-masked]>
Date: Tue, 1 May 2001 23:09:24 +0300

> the "unproven but unbroken" category.

There is also one by Rogaway et al. and a recent one by Katz et
al. (and the latter seems to avoid random oracles). Perhaps the point
is that provable security could be a factor when selecting new
protocols, although not a decisive one (as for example random oracles
have been criticized recently).

This is not really SRP specific, the SSH2 key exchange scheme does not
have a proof of security either.

Best regards, 
Mika Kojo

---

From: David Jablon <[email-masked]>
Date: Tue, 01 May 2001 21:08:36 -0400

Mika,

To elaborate on your points, I've listed some reasons
why one should be careful when considering what
"provable" security means in this field.

I'll also note that the task of describing the relative security
of password methods is one part of the evolving IEEE P1363.2
standard for password-based cryptography.

The main purpose of reduction proofs is to define an equivalence class
for methods that includes at least one very-well-studied and unbroken
method.  The goal is to prove that if you break one, then you've broken
them all.

Some issues with today's proofs are:

1. Proofs in this field are new and complex.

2. Not many people have the tools or skills to verify or evaluate the
correctness of such proofs.  This is especially true for password-based
protocols.  Who can say whether any individual proof or proof model
is flawless?  Proofs are great, but elegant proofs are rare.

3. Proof models vary among researchers.  

4. Acceptable assumptions to some people may be seen as a weakness
to others.  It seems a matter of taste as to how and when to use a
random oracle assumption.

5. Even in the absense of a reduction proof, the benefits of using a
well-studied and unbroken method may be too great to ignore
when the method is compared to known-to-be-broken alternative.

Proofs are important to identify the common foundations and common
unresolved questions underlying all these methods.  They provide a basis
to be more confident in a method.  But we must acknowledge their limitations.
Proofs are just another level in the imperfect art of cryptography.

Finally, here are some amendments to the list of published results for
password protocol reduction proofs:  A 1999 paper by MacKenzie and
Swaminathan proved SNAPI secure based on RSA and a random oracle
assumption.  But as far as I know, a full version of the 2000 Bellare and
Rogaway paper was never published. Links to these are at
www.IntegritySciences.com/links.html.  I also know of one other
new paper that is yet to be published.

-- David

Mika Kojo wrote:
>> > that it doesn't provide a security proof in the standard models. [...]

>have a proof of security either.

---------------------------------------------------
David P. Jablon
[email-masked]
www.IntegritySciences.com
www.Phoenix.com