PAKEs Dragonfly Results Conclusion On the Provable Security of the Dragonfly protocol Jean Lancrenon 1 Marjan Škrobot 1 1 Interdisciplinary Centre for Security, Reliability and Trust University of Luxembourg ISC 2015 1 / 18
PAKEs Dragonfly Results Conclusion Outline 1. PAKEs 2. Dragonfly 3. Results 4. Conclusion 2 / 18
PAKEs Dragonfly Results Conclusion Intro Password Authenticated Key Exchange PAKE Problem: 3 / 18
PAKEs Dragonfly Results Conclusion Intro Password Authenticated Key Exchange PAKE Problem: ◮ Setup: Shared low-entropy secret (password) 3 / 18
PAKEs Dragonfly Results Conclusion Intro Password Authenticated Key Exchange PAKE Problem: ◮ Setup: Shared low-entropy secret (password) ◮ Goal: High-entropy session key 3 / 18
PAKEs Dragonfly Results Conclusion Intro Password Authenticated Key Exchange PAKE Problem: ◮ Setup: Shared low-entropy secret (password) ◮ Goal: High-entropy session key ◮ Without PKI 3 / 18
PAKEs Dragonfly Results Conclusion Intro Password Authenticated Key Exchange PAKE Problem: ◮ Setup: Shared low-entropy secret (password) ◮ Goal: High-entropy session key ◮ Without PKI ◮ Only password for authentication 3 / 18
PAKEs Dragonfly Results Conclusion Intro Password Authenticated Key Exchange PAKE Problem: ◮ Setup: Shared low-entropy secret (password) ◮ Goal: High-entropy session key ◮ Without PKI ◮ Only password for authentication ◮ Prevent offline-dictionary attacks 3 / 18
PAKEs Dragonfly Results Conclusion Intro Password Authenticated Key Exchange PAKE Problem: ◮ Setup: Shared low-entropy secret (password) ◮ Goal: High-entropy session key ◮ Without PKI ◮ Only password for authentication ◮ Prevent offline-dictionary attacks ◮ Limit online-guessing attacks 3 / 18
PAKEs Dragonfly Results Conclusion Intro Design Techniques Typical approaches for designing efficient PAKEs in (ROM): 4 / 18
PAKEs Dragonfly Results Conclusion Intro Design Techniques Typical approaches for designing efficient PAKEs in (ROM): 1. "EKE-style" E pw ( g x ) − − − − − − − − − − → E pw ( g y ) ← − − − − − − − − − − 4 / 18
PAKEs Dragonfly Results Conclusion Intro Design Techniques Typical approaches for designing efficient PAKEs in (ROM): 1. "EKE-style" E pw ( g x ) − − − − − − − − − − → E pw ( g y ) ← − − − − − − − − − − 2. "SPEKE-style" ( H ( pw )) x − − − − − − − − − − → ( H ( pw )) y ← − − − − − − − − − − 4 / 18
PAKEs Dragonfly Results Conclusion Intro Design Techniques Typical approaches for designing efficient PAKEs in (ROM): 1. "EKE-style" E pw ( g x ) − − − − − − − − − − → E pw ( g y ) ← − − − − − − − − − − 2. "SPEKE-style" ( H ( pw )) x − − − − − − − − − − → ( H ( pw )) y ← − − − − − − − − − − 3. "J-PAKE-style" ( D 1 ) xpw , π 1 − − − − − − − − − − → ( D 2 ) ypw , π 2 ← − − − − − − − − − − 4 / 18
PAKEs Dragonfly Results Conclusion Security Models Security Models for PAKE PAKE Security Models: 5 / 18
PAKEs Dragonfly Results Conclusion Security Models Security Models for PAKE PAKE Security Models: 1. Indistinguishability-Based Model [BR93,95] ◮ Find-then-Guess [BPR00] ◮ Real-or-Random [AFP05] 5 / 18
PAKEs Dragonfly Results Conclusion Security Models Security Models for PAKE PAKE Security Models: 1. Indistinguishability-Based Model [BR93,95] ◮ Find-then-Guess [BPR00] ◮ Real-or-Random [AFP05] 2. Simulation-Based Model [S99] ◮ Modified Shoup’s model [BMP00] ◮ Plain model PAKEs [GL01] 5 / 18
PAKEs Dragonfly Results Conclusion Security Models Security Models for PAKE PAKE Security Models: 1. Indistinguishability-Based Model [BR93,95] ◮ Find-then-Guess [BPR00] ◮ Real-or-Random [AFP05] 2. Simulation-Based Model [S99] ◮ Modified Shoup’s model [BMP00] ◮ Plain model PAKEs [GL01] 3. Universal Composability Model [CK02] ◮ UC for PAKE [CHKLM05] 5 / 18
PAKEs Dragonfly Results Conclusion Security Models Security Models for PAKE PAKE Security Models: 1. Indistinguishability-Based Model [BR93,95] ◮ Find-then-Guess [BPR00] ◮ Real-or-Random [AFP05] 2. Simulation-Based Model [S99] ◮ Modified Shoup’s model [BMP00] ◮ Plain model PAKEs [GL01] 3. Universal Composability Model [CK02] ◮ UC for PAKE [CHKLM05] 5 / 18
PAKEs Dragonfly Results Conclusion Indistinguishability-Based Model for PAKEs Find-then-Guess BPR Model Queries available to PPT adversary A : Send( U i , M ) - message exchange ◮ Send ◮ Execute Execute( C i , S j ) - eavesdropping ◮ Reveal Reveal( U i ) - leakage of the session key ◮ Corrupt Corrupt( U ) - leakage of the long term secret* Test( U i ) - semantic security of the session key ◮ Test 6 / 18
PAKEs Dragonfly Results Conclusion Indistinguishability-Based Model for PAKEs Find-then-Guess BPR Model Queries available to PPT adversary A : Send( U i , M ) - message exchange ◮ Send ◮ Execute Execute( C i , S j ) - eavesdropping ◮ Reveal Reveal( U i ) - leakage of the session key ◮ Corrupt Corrupt( U ) - leakage of the long term secret* Test( U i ) - semantic security of the session key ◮ Test What security means in BPR model? 6 / 18
PAKEs Dragonfly Results Conclusion Indistinguishability-Based Model for PAKEs Find-then-Guess BPR Model Queries available to PPT adversary A : Send( U i , M ) - message exchange ◮ Send ◮ Execute Execute( C i , S j ) - eavesdropping ◮ Reveal Reveal( U i ) - leakage of the session key ◮ Corrupt Corrupt( U ) - leakage of the long term secret* Test( U i ) - semantic security of the session key ◮ Test What security means in BPR model? Definition Protocol P is forward secure PAKE if for all PPT adversaries A making at most n se online attempts, where N is the size of the dictionary and C is a constant ( A ) ≤ C · n se Adv ake Adv + ε . (1) P N 6 / 18
PAKEs Dragonfly Results Conclusion The Dragonfly Protocol Motivation Why Dragonfly? 7 / 18
PAKEs Dragonfly Results Conclusion The Dragonfly Protocol Motivation Why Dragonfly? ◮ Submitted for standard in IETF (patent free) ◮ Dragonfly PAKE ◮ PSK (PWD) for IKE - RFC 6617 (Experimental), 2012 ◮ EAP-PWD - RFC 5931 (Informational), 2010 ◮ TLS-PWD 7 / 18
PAKEs Dragonfly Results Conclusion The Dragonfly Protocol Motivation Why Dragonfly? ◮ Submitted for standard in IETF (patent free) ◮ Dragonfly PAKE ◮ PSK (PWD) for IKE - RFC 6617 (Experimental), 2012 ◮ EAP-PWD - RFC 5931 (Informational), 2010 ◮ TLS-PWD ◮ Fully symmetric (no strict roles) 7 / 18
PAKEs Dragonfly Results Conclusion The Dragonfly Protocol Motivation Why Dragonfly? ◮ Submitted for standard in IETF (patent free) ◮ Dragonfly PAKE ◮ PSK (PWD) for IKE - RFC 6617 (Experimental), 2012 ◮ EAP-PWD - RFC 5931 (Informational), 2010 ◮ TLS-PWD ◮ Fully symmetric (no strict roles) ◮ Follows SPEKE design approach 7 / 18
PAKEs Dragonfly Results Conclusion The Dragonfly Protocol Motivation Why Dragonfly? ◮ Submitted for standard in IETF (patent free) ◮ Dragonfly PAKE ◮ PSK (PWD) for IKE - RFC 6617 (Experimental), 2012 ◮ EAP-PWD - RFC 5931 (Informational), 2010 ◮ TLS-PWD ◮ Fully symmetric (no strict roles) ◮ Follows SPEKE design approach ◮ Without security proof 7 / 18
PAKEs Dragonfly Results Conclusion The Dragonfly Protocol Motivation Why Dragonfly? ◮ Submitted for standard in IETF (patent free) ◮ Dragonfly PAKE ◮ PSK (PWD) for IKE - RFC 6617 (Experimental), 2012 ◮ EAP-PWD - RFC 5931 (Informational), 2010 ◮ TLS-PWD ◮ Fully symmetric (no strict roles) ◮ Follows SPEKE design approach ◮ Without security proof ◮ Stirred some controversy 7 / 18
PAKEs Dragonfly Results Conclusion The Dragonfly Protocol Dragonfly draft specifications Client Server Initialization Public: G , p , q ; H 0 , H 2 : { 0 , 1 } ∗ → { 0 , 1 } k ; H 1 : { 0 , 1 } ∗ → { 0 , 1 } 2 k ; π ∈ Passwords ; seed := H 0 ( C, S, π, c ) max,min ; PW := H & P ( seed, l 1 ). m 1 , r 1 ← Z q m 2 , r 2 ← Z q s 1 := r 1 + m 1 s 2 := r 2 + m 2 E 1 := PW − m 1 E 2 := PW − m 2 C, E 1 , s 1 S, E 2 , s 2 abort if ¬ Good( E 2 , s 2 ) abort if ¬ Good( E 1 , s 1 ) σ := ( PW s 2 × E 2 ) r 1 σ := ( PW s 1 × E 1 ) r 2 kck | sk C := H 1 ( σ, l 2 ) kck | sk S := H 1 ( σ, l 2 ) κ := H 2 ( kck, C, s 1 , s 2 , E 1 , E 2 ) τ := H 2 ( kck, S, s 2 , s 1 , E 2 , E 1 ) ˆ τ := H 2 ( kck, S, s 2 , s 1 , E 2 , E 1 ) ˆ κ := H 2 ( kck, C, s 1 , s 2 , E 1 , E 2 ) κ τ abort if τ � = ˆ τ abort if κ � = ˆ κ 8 / 18
Recommend
More recommend
