[Search] [txt|pdf|bibtex] [Tracker] [Email] [Nits]

Versions: 00 01 02 03 04 05 06                                          
Internet Research Task Force                                     Harkins
Internet-Draft                                             HP Enterprise
Intended status: Informational                        September 12, 2016
Expires: March 16, 2017


                                  PKEX
                         draft-harkins-pkex-00

Abstract

   This memo describes a password-authenticated protocol to allow two
   devices to exchange "raw" (uncertified) public keys and establish
   trust that the keys belong to their respective identities.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on March 16, 2017.

Copyright Notice

   Copyright (c) 2016 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.





Harkins                  Expires March 16, 2017                 [Page 1]


Internet-Draft             Public Key Exchange            September 2016


Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
     1.1.  Requirements Language . . . . . . . . . . . . . . . . . .   2
     1.2.  Notation  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Properties  . . . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  Assumptions . . . . . . . . . . . . . . . . . . . . . . . . .   4
   4.  Protocol Definition . . . . . . . . . . . . . . . . . . . . .   4
     4.1.  Exchange Phase  . . . . . . . . . . . . . . . . . . . . .   5
     4.2.  Commit Phase  . . . . . . . . . . . . . . . . . . . . . .   5
     4.3.  Reveal Phase  . . . . . . . . . . . . . . . . . . . . . .   6
   5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   7
   6.  Security Considerations . . . . . . . . . . . . . . . . . . .   7
   7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   8
     7.1.  Normative References  . . . . . . . . . . . . . . . . . .   8
     7.2.  Informative References  . . . . . . . . . . . . . . . . .   8
   Appendix A.  Appendix . . . . . . . . . . . . . . . . . . . . . .   9
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   9

1.  Introduction

   Many authenticated key exchange protocols allow for authentication
   using uncertified, or "raw", public keys, for example TLS
   ([RFC7250]), or IKEv2 ([RFC7670]) Usually these specifications state
   that "establishing trust in raw public keys is outside the scope of
   this standard."  The Public Key Exchange (PKEX) is designed to fill
   that gap and enable the establishment of trust in public keys that
   can subsequently be used to faccilitate authentication in other
   authentication and key exchange protocols.

1.1.  Requirements Language

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [RFC2119].

1.2.  Notation

   This memo describes a cryptographic exchange using sets of elements
   called groups.  Groups can be either traditional finite field or can
   be based on elliptic curves.  The public keys exchanged by PKEX are
   elements in a group.  Elements in groups are denoted in upper-case
   and scalar values are denoted with lower-case.  The generator of the
   group is G.

   When both the initator and responder use a similar, but unique, datum
   it is denoted by appending an "i" for initiator or "r" for responder,




Harkins                  Expires March 16, 2017                 [Page 2]


Internet-Draft             Public Key Exchange            September 2016


   e.g. if each side needs an element C then the initiator's is Ci and
   the responder's is Cr.

   During the exchange, one side will generate data and the other side
   will attempt to reconstruct it.  The reconstructed data is "primed".
   That is, if the initiator generates C then when responder tries to
   reconstruct it, the responder will refer to it as C'.  Data that is
   directly sent and received is not primed.

   The following notation is used in this memo:

   C = A + B
       The "group operation" on two elements, A and B, that produces a
       third element, C.  For finite field cryptography this is the
       modular multiplication, for elliptic curve cryptography this is
       point addition.

   C = a * B
       This denotes repeated application of the group operation to B--
       i.e.  B + B-- (a - 1) times.

   a = H(b)
       A cryptographic hash function that takes data b of indeterminate
       length and returns a fixed sized digest a.

   a = F(B)
       A mapping function that takes an element and returns a scalar.
       For elliptic curve cryptography, F() returns the x-coordinate of
       the point B.  For finite field cryptography, F() is the identity
       function.

   a = KDF(b, c)
       A key derivation function that derives an output key a from an
       input key b and context c.

   c = a | b
       Concatentation of data a with data b producing c.

2.  Properties

   Subversion of PKEX involves an adversary being able to insert its own
   public key into the exchange resulting in one of the parties to the
   exchange believing the adversary's public key actually belongs to the
   protocol peer.

   PKEX has the following properties:





Harkins                  Expires March 16, 2017                 [Page 3]


Internet-Draft             Public Key Exchange            September 2016


   o  An adversary is unable to subvert the exchange without knowing the
      password.

   o  An adversary is unable to discover the password through passive
      attack.

   o  The only information exposed by an active attack is whether a
      single guess of the password is correct or not.

   o  Proof-of-possession of the private key is provided.

   o  At the end of the protocol, either trust is established in the
      peer's public key or the exchange fails.

3.  Assumptions

   Due to the nature of the exchange, only DSA ([DSS]) and ECDSA
   ([X9.62]) keys can be exchanged with PKEX.

   PKEX requires fixed elements that are unique to the particular role
   in the protocol, an initiator-specific element and a responder-
   specific element.  They need not be secret.  It is assumed that both
   parties know the role-specific elements for the particular group in
   which their key pairs were derived.  This memo does not proscribe any
   way to generate these role-specific elements but the "Hunting and
   Pecking" technique of [RFC7664] could be used with a slight
   variation.  Instead of inputting a password and generating a secret
   element, a common string such as "PKEX Initiator Element" can be used
   to generate a public element.  For elliptic curve cryptography, the
   technique of "hashing into an elliptic curve" from [hash2ec] could be
   used, again with a common string, to produce role-specific elements.

   The following assumptions are made on PKEX:

   o  Only the peers involved in the exchange know the password.

   o  The peers' public keys are from the same group.

   o  The discrete logarithms of the public role-specific elements are
      unknown, and determining them is computationally infeasible.

4.  Protocol Definition

   PKEX is a balanced PAKE.  The identical version of the password is
   used by both parties.






Harkins                  Expires March 16, 2017                 [Page 4]


Internet-Draft             Public Key Exchange            September 2016


   PKEX consists of three phases: exchange, commit, and reveal.  It is
   described using the popular protocol participants, Alice (an
   initiator of PKEX), and Bob (a responder of PKEX).

   We denote Alice's role-specific element a Pi and Bob's as Pr.  The
   password is pw.  For simplicity, Alice's identity is "Alice" and
   Bob's identity is "Bob".  Alice's public key she wants to share with
   Bob is A and her private key is a, while Bob's public key he wants to
   share with Alice is B and his private key is b.

4.1.  Exchange Phase

   The Exchange phase is essentially the SPAKE key exchange.  The peers
   derive ephemeral public keys, encrypt, and exchange them.  Each party
   hashes a concatentation of his or her identity and the password and
   operates on the role-specific element to obtain a secret encrypting
   element.  The group operation is then performed with the ephemeral
   key and the secret encrypting element to produce an encrypted
   ephmeral key.

         Alice:                           Bob:
         ------                           ----
     x, X = x*G                         y, Y = y*G
     Qi = H(Alice|pw)*Pi                Qr = H(Bob|pw)*Pr
     M = X + Qa
                           M ------>
                                        Qi = H(Alice|pw)*Pi
                                        X' = M - Qi
                                        N = Y + Qr
                           <------ N
     Qr = H(Bob|pw)*Pr
     Y' = N - Qr

   At this point in time the peers have exchanged ephemeral elements
   that will be unknown except by someone with knowledge of the
   password.  Given our assumptions that means only Alice and Bob can
   know the elements X and Y.

   The secret encrypting elements are irretrievably deleted at this
   point.

4.2.  Commit Phase

   In the Commit phase the peers commit to the particular public key
   they wish to exchange.






Harkins                  Expires March 16, 2017                 [Page 5]


Internet-Draft             Public Key Exchange            September 2016


         Alice:                              Bob:
         ------                              ----
     sa = F(a*Y')
     ka = KDF(sa, F(M) | F(N) |
              F(A) | F(Y') | pw)
     u = HMAC(ka, F(X) | F(Y') |
              F(A) | Alice | 0)
                            u ------>
                                        sb = F(b*X')
                                        kb = KDF(sb, F(N) | F(M) |
                                                 F(B) | F(X') | pw)
                                        v = HMAC(kb, F(Y) | F(X') |
                                                 F(B) | Bob | 1)
                            <------ v

   where 0 and 1 are single octets of the value zero and one,
   respectively.

   At this point the parties have committed to their public/private key
   pairs but have net yet exchanged their public keys.  There is no
   proof that either side possesses the private key or whether the
   public key is really the analog to the private key but they have made
   irrevocable committments to those statements.

4.3.  Reveal Phase

   In the Reveal phase the peers encrypt their public keys using a
   secret element derived from the exchange in the Commit phase.  This
   allows each side to determine the other's public key and verify that
   the peer holds the private key.





















Harkins                  Expires March 16, 2017                 [Page 6]


Internet-Draft             Public Key Exchange            September 2016


         Alice:                            Bob:
         ------                            ----
     Z = x*Y'
     R = A + Z
                            R ------>
                                        Z = y*X'
                                        A' = R - Z
                                        sa' = F(y*A')
                                        ka' = KDF(sa', F(M) | F(N) |
                                                  F(A') | F(Y) | pw)
                                        u' = HMAC(ka', F(X') | F(Y) |
                                                  F(A') | Alice | 0)
                                        if (u' != u) fail
                                        T = B + Z
                            <------ T
     B' = T - Z
     sb' = F(x*B')
     kb' = KDF(sb', F(N) | F(M) |
               F(B') | F(X) | pw)
     v' = HMAC(kb', F(Y') | F(X) |
               F(B') | Bob | 1)
     if (v'!= v) fail

   where 0 and 1 are single octets of the value zero and one,
   respectively.

   At this point, if the parties didn't fail they have each other's
   public key and trust that it belongs to the peer's stated identlty.
   They can use the public key in another protocol to authenticate that
   identity.  They provided proof of possession by binding their private
   key to the peer's ephemeral share made during the Exchange phase,
   they signed their public key with the resulting secret.  The ability
   of the peer to compute this secret and verify the data exchanged
   during the Commit phase demonstrates the public key is the analog to
   the private key.

5.  IANA Considerations

   This memo could create a registry of the fixed public elements for a
   nice cross section of popular groups.  Or not.  If it ends up doing
   so there will be IANA Considerations here, otherwise there won't be.

6.  Security Considerations

   The encrypted shares exchanged in the Exchange phase MUST be
   ephemeral.  Reuse of these keys, even with a different password,
   voids the security of the exchange.




Harkins                  Expires March 16, 2017                 [Page 7]


Internet-Draft             Public Key Exchange            September 2016


   The discrete logaritm of the fixed public elements MUST not be known.
   Knowledge of either of these values voids the security of the
   exchange.

   For PKEX to be useful, a public key is going to be exchanged with a
   multitude of people and once exchanged the public key is, well,
   public.  This means that an adversary will know the public key that a
   particular peer wants to exchange in a future run of PKEX.  With this
   knowledge an adversary can attack the Reveal exchange and, knowing A
   (or B), determine Z for the PKEX exchange and insert her public key.
   This will fail, though, because A (or B) was committed to in the
   Commit phase.  The adversary is unable to subvert the Commit phase
   because, while knowing A (or B) she does not know the corresponding
   private key and does not know the ephemeral share that the peer
   provided since she does not know the password.

   There is no proof of security of PKEX at this time.

7.  References

7.1.  Normative References

   [DSS]      U.S. Department of Commerce/National Institute of
              Standards and Technology, "Digital Signature Standard
              (DSS)", Federal Information Processing Standards FIPS PUB
              186-4, July 2013.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [X9.62]    American National Standards Institute, "X9.62-2005",
              Public Key Cryptography for the Financial Services
              Industry (ECDSA), 2005.

7.2.  Informative References

   [RFC7250]  Wouters, P., Ed., Tschofenig, H., Ed., Gilmore, J.,
              Weiler, S., and T. Kivinen, "Using Raw Public Keys in
              Transport Layer Security (TLS) and Datagram Transport
              Layer Security (DTLS)", RFC 7250, DOI 10.17487/RFC7250,
              June 2014, <http://www.rfc-editor.org/info/rfc7250>.

   [RFC7664]  Harkins, D., Ed., "Dragonfly Key Exchange", RFC 7664, DOI
              10.17487/RFC7664, November 2015,
              <http://www.rfc-editor.org/info/rfc7664>.






Harkins                  Expires March 16, 2017                 [Page 8]


Internet-Draft             Public Key Exchange            September 2016


   [RFC7670]  Kivinen, T., Wouters, P., and H. Tschofenig, "Generic Raw
              Public-Key Support for IKEv2", RFC 7670, DOI 10.17487/
              RFC7670, January 2016,
              <http://www.rfc-editor.org/info/rfc7670>.

   [hash2ec]  Coron, J-S. and T. Icart, "An indifferentiable hash
              function into elliptic curves", Cryptology ePrint Archive
              Report 2009/340, 2009.

Appendix A.  Appendix

   Maybe show a sample PKEX exchange

Author's Address

   Dan Harkins
   HP Enterprise
   1322 Crossman avenue
   Sunnyvale, California  94089
   USA

   Phone: +1 415 997 9834
   Email: dharkins@lounge.org




























Harkins                  Expires March 16, 2017                 [Page 9]