Subject: [IPsec] Agenda for Anaheim

From: Paul Hoffman <[email-masked]>
Date: Wed, 10 Mar 2010 11:12:38 -0800

Greetings again. The first draft of the agenda for the Anaheim meeting is now up at <http://www.ietf.org/proceedings/10mar/agenda/ipsecme.txt>. It currently reads:

0900 Agenda bash
0905 Brief review of document status
0915 IPsec HA - Yoav Nir
0930 EAP-only authentication - Yaron Sheffer
0945 Failure detection discussion - Paul Hoffman
1015 PAKE authentication discussion - Paul Hoffman
1100 Roadmap discussion, if issues are still open
1130 Adjourn

Discussion is welcome. (But even more welcome would be comments on the Roadmap documents...)

--Paul Hoffman, Director
--VPN Consortium

---

From: "SeongHan Shin" <[email-masked]>
Date: Thu, 11 Mar 2010 12:03:08 +0900

Dear Paul Hoffman,

I'm Shin.

I submitted the below I-D (00) and have just finished the IPR disclosure one
hour ago.
Could you please let me know if it is possible for me to present
our work in IPsecme WG?

Filename:        draft-shin-augmented-pake
Revision:        00
Title:           Most Efficient Augmented Password-Only Authentication and
Key Exchange
Creation_date:   2010-03-01
WG ID:           Independent Submission
Number_of_pages: 14

Abstract:
This document describes an efficient augmented password-only
authentication and key exchange (AugPAKE) protocol where a user
remembers a low-entropy password and its verifier is registered in
the intended server.  In general, the user password is chosen from a
small set of dictionary whose space is within the off-line dictionary
attacks.  The AugPAKE protocol described here is secure against
passive attacks, active attacks and off-line dictionary attacks (on
the obtained messages with passive/active attacks), and also provides
resistance to server compromise (in the context of augmented PAKE
security).

Best regards,
Shin

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Paul Hoffman
> Sent: Thursday, March 11, 2010 4:13 AM
> To: IPsecme WG
> Subject: [IPsec] Agenda for Anaheim
> 
> Greetings again. The first draft of the agenda for the Anaheim meeting is
> now up at <http://www.ietf.org/proceedings/10mar/agenda/ipsecme.txt>. It
> currently reads:
> 
> 0900 Agenda bash
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 10 Mar 2010 20:02:25 -0800

>Could you please let me know if it is possible for me to present

We are not focusing on specific presentations, but instead on the criteria that the WG should be using to use to choose which proposal, or variant of a proposal, we want to go forward with. Please see the earlier discussion on those criteria, and feel free to say how you feel this proposal fits into those criteria, as well as the criteria for which you think your proposal is strong.

--Paul Hoffman, Director
--VPN Consortium

---

From: "SeongHan Shin" <[email-masked]>
Date: Thu, 11 Mar 2010 15:17:59 +0900

Dear Paul Hoffman,

Thank you for your quick response.
Below is the summary.

This draft <draft-shin-augmented-pake-00.txt> describes AugPAKE. 

For simplicity, I discuss some criteria (written in
<draft-sheffer-ipsecme-pake-criteria-00.txt> and appeared in IPsecme WG
mailing list).
If I miss something, please let me know.

For references of EKE, SRP, SPSK, SPEKE and PAK, see
<draft-sheffer-ipsecme-pake-criteria-00.txt>.

----------------------------------------------------------------
1. Security
PAKE can be divided into balanced PAKE and augmented PAKE.

Balanced PAKE provides security against only active attacks (including
off-line dictionary attacks).
Examples: EKE, SPSK, SPEKE, PAK

Augmented PAKE provides security of balanced PAKE + "resistance to server
compromise" (see our draft for this security property)
Examples: SRP, AugPAKE

2. Underlying groups
AugPAKE over any groups (e.g., MODP, ECP) where the Diffie-Hellman problem
holds.

EKE, SRP and PAK need a care when selecting groups because of ideal cipher,
protocol structure or FDH (Full-Domain Hash).
FDH maps a hashed value to a group element.

3. Implementation
Because of the above reason, AugPAKE can be easily implemented.
We already implemented AugPAKE.

4. Efficiency
1) AugPAKE requires less modular exponentiation than SRP and SPSK.
It is almost same as EKE, SPEKE and PAK.

2) Number of rounds of AugPAKE is same as SRP (4 rounds).
3 rounds: EKE, SPSK (can be adjusted), SPEKE, PAK

5. Intellectual property
AIST will provide a royalty-free license for implementations of AugPAKE.
We think that AugPAKE is not involved to other patents.
(But, I am not a patent lawyer)
----------------------------------------------------------------

Best regards,
Shin

> Sent: Thursday, March 11, 2010 1:02 PM
> To: SeongHan Shin
> Cc: 'IPsecme WG'; 'Kazukuni Kobara'; 'SeongHan Shin'
> Subject: Re: [IPsec] Agenda for Anaheim
> 
> We are not focusing on specific presentations, but instead on the criteria
> that the WG should be using to use to choose which proposal, or variant
> of a proposal, we want to go forward with. Please see the earlier
discussion
> on those criteria, and feel free to say how you feel this proposal fits
> into those criteria, as well as the criteria for which you think your
> proposal is strong.
> 
> --Paul Hoffman, Director
> --VPN Consortium