[TLS] draft-ietf-tls-pake update and analysis

Hi folks,

Our preliminary analysis of draft-ietf-tls-pake is now available [0]. To summarize, we took the updated TLS 1.3 model used for ECH [1] and added support for the (internal) PAKE extension. At a high level, it demonstrates the following:

- Mutual authentication: agreement of session key and identities, accounting for replay attacks
- Key secrecy: session key not known to attacker
- Forward secrecy: breaking past sessions does not compromise future ones
- Regressions: normal TLS properties hold

Our writeup is at [2]. Here are some noteworthy highlights:

- We model the PAKE as a black box where both parties input passwords (or password verifiers) and then the PAKEs output an authenticated PSK that is used in the TLS handshake. 
- We don't model low entropy passwords, meaning dictionary attacks are out of scope. We assume the black box PAKEs make this work. 
- Combinations with other TLS features such as certificate-based authentication, which is allowed in the draft, as well as ECH, are not modeled. 
- Per-client information in augmented PAKE settings are modeled by folding them into the password. We made this simplification because the underlying PAKE handles the asymmetric information property.

Surely more can be done, but this is what we have, and we believe it's suitable enough to initiate the FATT assessment process. I'll talk about that during Friday's session.

Best,
Chris

[0] https://github.com/chris-wood/tls-pake-model
[1] https://gitlab.cs.ox.ac.uk/vinval/ech-tls
[2] https://github.com/chris-wood/tls-pake-model/blob/main/PAKE_ANALYSIS.md
_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]