Questions tagged [pake]
Password-Authenticated Key Exchanges (PAKE) are authenticated key exchange protocols where the long term secret is a (low entropy) password. I.e., it's a 2-party protocol with at least one party using a password to authenticate themselves to the other party. A PAKE guarantees, that the parties establish a shared session key if and only if authentication was successful. Due to the low entropy of passwords, it's crucial to prevent offline dictionary attacks.
43 questions
0 votes
0 answers
36 views
Are unique identifiers acceptable salts for client-side key stretching?
Background: The OPAQUE aPAKE scheme is vulnerable to quantum computing shenanigans. If we directly blind the user's password using the scheme, then we give attackers the opportunity to "harvest ...
- 347
3 votes
1 answer
139 views
Is the user's password revealed to a curious server in the OPAQUE PAKE?
If the server is honest-but-curious, it can attempt to guess the user’s password $\mathsf{pw}$ by computing $\mathsf{rw} = H(\mathsf{pw}, H'(\mathsf{pw})^s)$,where $s$ is the server's OPRF key. Then, ...
3 votes
1 answer
85 views
In SPAKE2(+) is it safe for B to send the key confirmation first?
Both RFC 9382 (SPAKE2) and RFC 9383 (SPAKE2+) have language that seems to require 4 messages to complete the protocol. In particular, A sends a key confirmation message cA to B, and B responds with ...
- 1,784
2 votes
1 answer
103 views
Does FIPS have any PAKE algorithms?
Are there any password-authenticated key exchange (PAKE) algorithms in FIPS standards?
- 2,645
2 votes
1 answer
187 views
Is PAKE more secure than WPA2?
As I understand it, in WPA2, the shared key (for encryption) is derived from the password, plus nonces and identities used in the initial 4-way exchange. An attacker who was able to sniff the initial ...
- 117
2 votes
0 answers
109 views
Could a Yubikey Provide the Optional Secret to OPAQUE When Using Argon2?
I've been studying the OPAQUE protocol, and I like it (so far). The RFC suggests using Argon2 as the Key-Stretching Function. Argon2 can take an optional "Secret value" (2, page 5). I had ...
- 121
1 vote
0 answers
130 views
Password entropy requirements for online dictionary attacks on OPAQUE?
My understanding is that for PAKE protocols such as OPAQUE (https://eprint.iacr.org/2018/163.pdf), the the adversary has no choice but to just do online attacks on the password. If this is true, I ...
- 83
4 votes
1 answer
596 views
"Oblivious" Argon2id? (or comparable KDF/KSF)?
Is it possible for a client to send a blinded password to a server, so that the server does key derivation+stretching on that blinded value, but the key can then be unblinded by the client? ...
- 309
1 vote
1 answer
135 views
Anonymous PAKE using two party computation
Let's say client side has a secret password $\pi$. The server has a series of indices $0..n-1$ and a salt associated value $s_i$ for all $i \in \{0,n-1\}$ call it set $S=\{s_i | i \in \{0,n-1\}\}$ ...
- 671
3 votes
1 answer
166 views
Is the following PAKE protocol UC secure?
Consider the following (simplification of a) PAKE protocol: Alice and Bob start with a pre-agreed password pw. To establish a new session key $k$, first Alice samples a random nonce $r$ and sends it ...
- 33
3 votes
2 answers
309 views
Why does the PAKE ideal functionallity allow the keys to be the same when the passwords differ?
My intuition for the security a symmetric PAKE is supposed to provide comes from the example of a login page. Both the user and the server know the password (assuming unhashed passwords), and the ...
- 258
2 votes
1 answer
423 views
Questions on PRF
Define three hash functions: $H_1: \{0, 1\}^* \rightarrow \mathbb{G}$ mapping $x$ to the group $\mathbb{G}$ of prime order $q$ $H_2: \mathbb{G} \rightarrow \{0, 1\}^\tau$ $H_3: \{0, 1\}^* \times \...
- 151
4 votes
2 answers
681 views
Have any PAKE extensions been added to TLS 1.3?
In TLS 1.2, there was TLS-SRP (RFC 5054,) which provided a password-authenticated key exchange (PAKE) protocol for use with TLS. However, it apparently relied on handshake messages that have been ...
- 175
0 votes
0 answers
56 views
What is the purpose of hashing the identifier in the secure remote password (SRP) protocol? [duplicate]
In the secure remote password protocol version 6a, the identifier for the user, I, is hashed along with the salt and the password on the client. While I understand ...
- 1
5 votes
2 answers
532 views
What's going on with the complicated implementations for map_to_curve in draft-irtf-cfrg-hash-to-curve?
I've been looking into implementing cPace, and I saw that two cipher suites defined for it refered to draft-irtf-cfrg-hash-to-curve for its protocol definition. Part of cPace requires mapping a string ...
- 153