RFC 7664
Dragonfly Key Exchange
RFC 7664: Dragonfly Key Exchange 🦋
okay bestie, this is the title block 💅 It's an Informational RFC from the IRTF stream, and it was published in November 2015 (ISSN 2070-1721). The editor is D. Harkins, Ed. from Aruba Networks. The header doesn't list any documents it obsoletes or updates, so there's nothing to swap out 🌸
Abstract ✨
ok so this doc specifies a key exchange that uses discrete logarithm cryptography and gets authenticated with a password or passphrase 🔐 It's resistant to active attack, passive attack, AND offline dictionary attack, which is seriously iconic 👑 It's a product of the Crypto Forum Research Group (CFRG) 💜
Status of This Memo
this is NOT an Internet Standards Track spec, it's just published for informational purposes 📚
it's a product of the Internet Research Task Force (IRTF), which publishes results of Internet-related research and development 🔬 those results might not be suitable for deployment, so be careful 💀 this RFC is just the individual opinion(s) of one or more members of the CFRG of the IRTF 🙈 docs approved for publication by the IRSG are not a candidate for any level of Internet Standard, see Section 2 of RFC 5741 🍓
for current status, errata, and how to give feedback, check http://www.rfc-editor.org/info/rfc7664 🧚
Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved. 🎀
this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication. please review those docs carefully, bestie, because they describe your rights and restrictions with respect to this document 📜
Table of Contents 🌈
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 2
1.2. Definitions . . . . . . . . . . . . . . . . . . . . . . . 3
1.2.1. Notations . . . . . . . . . . . . . . . . . . . . . . 3
1.2.2. Resistance to Dictionary Attack . . . . . . . . . . . 3
2. Discrete Logarithm Cryptography . . . . . . . . . . . . . . . 4
2.1. Elliptic Curve Cryptography . . . . . . . . . . . . . . . 4
2.2. Finite Field Cryptography . . . . . . . . . . . . . . . . 5
3. The Dragonfly Key Exchange . . . . . . . . . . . . . . . . . 6
3.1. Assumptions . . . . . . . . . . . . . . . . . . . . . . . 7
3.2. Derivation of the Password Element . . . . . . . . . . . 8
3.2.1. Hunting and Pecking with ECC Groups . . . . . . . . . 10
3.2.2. Hunting and Pecking with MODP Groups . . . . . . . . 12
3.3. The Commit Exchange . . . . . . . . . . . . . . . . . . . 13
3.4. The Confirm Exchange . . . . . . . . . . . . . . . . . . 14
4. Security Considerations . . . . . . . . . . . . . . . . . . . 15
5. References . . . . . . . . . . . . . . . . . . . . . . . . . 16
5.1. Normative References . . . . . . . . . . . . . . . . . . 16
5.2. Informative References . . . . . . . . . . . . . . . . . 16
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 18
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 181. Introduction ✨
okay so passwords and passphrases are literally the main way people authenticate on the Internet today 🔑 A lot of protocols use password-derived data as a proof-of-knowledge of the password (see [RFC7296] and [RFC5433], for example) 💅 The problem is this opens the door to an offline dictionary attack 💀 The attacker picks up enough info from an active or passive attack on the protocol, runs through a pool of potential passwords, computes verifiers, and keeps going until one matches the password-derived data 😭
this protocol uses discrete logarithm cryptography to do an efficient exchange that gives mutual authentication with a password, and it's provably resistant to offline dictionary attack 🔥 the CFRG consensus on this doc was rough ngl 🙈
1.1. Requirements Language
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 📖
1.2. Definitions 🎀
1.2.1. Notations
the following notations are used in this memo 🧮
- password: a shared, secret, and potentially low-entropy word, phrase, code, or key used as a credential to mutually authenticate the peers. It is not restricted to characters in a human language. 🔐
a | b: denotes concatenation of bit string "a" with bit string "b". 🔗len(a): indicates the length in bits of the bit string "a". 📏lsb(a): returns the least-significant bit of the bit string "a". 💜lgr(a,b): takes "a" and a prime, "b", and returns the Legendre symbol (a/b). 🌸min(a,b): returns the lexicographical minimum of strings "a" and "b", or zero (0) if "a" equals "b". ⭐max(a,b): returns the lexicographical maximum of strings "a" and "b", or zero (0) if "a" equals "b". 🌈
the convention for this memo is to represent an element in a finite cyclic group with an uppercase letter or acronym, and a scalar gets a lowercase letter or acronym 🦋 An element that represents a point on an elliptic curve has an implied composite nature, meaning it has both an x- and y-coordinate 🧚
1.2.2. Resistance to Dictionary Attack
ok so resistance to dictionary attack means any advantage an adversary gains must be directly related to the number of interactions she makes with an honest protocol participant, and NOT through computation 🙅♀️ The adversary can't learn anything about the password except whether one single guess from a protocol run is correct or incorrect 🫶
2. Discrete Logarithm Cryptography 🔥
Dragonfly uses discrete logarithm cryptography to get authentication and key agreement (see [SP800-56A]) 💖 Each party to the exchange derives ephemeral keys with respect to a particular set of domain parameters, which this doc calls a "group" 🌸 A group can be based on Finite Field Cryptography (FFC) or Elliptic Curve Cryptography (ECC) ✨
three operations are defined for both types of groups 👑
- "scalar operation": takes a scalar and an element in the group to produce another element.
Z = scalar-op(x, Y)- "element operation": takes two elements in the group to produce a third.
Z = element-op(X, Y)- "inverse operation": takes an element and returns another element such that the element operation on the two produces the identity element of the group.
Y = inverse(X)2.1. Elliptic Curve Cryptography 🌈
domain parameters for the ECC groups used by Dragonfly are:
- A prime, p, determining a prime field GF(p). The cryptographic group is a subgroup of the full elliptic curve group, which consists of points on an elliptic curve (elements from GF(p) that satisfy the curve's equation) together with the "point at infinity" that serves as the identity element. The group operation for ECC groups is addition of points on the elliptic curve. 💫
- Elements a and b from GF(p) that define the curve's equation. The point (x, y) in GF(p) x GF(p) is on the elliptic curve if and only if
(y^2 - x^3 - a*x - b) mod pequals zero (0). 📐 - A point, G, on the elliptic curve, which serves as a generator for the ECC group. G is chosen such that its order, with respect to elliptic curve addition, is a sufficiently large prime. 🧚
- A prime, q, which is the order of G, and thus is also the size of the cryptographic subgroup that is generated by G. 🦋
an (x,y) pair is a valid ECC element if: 1) the x- and y-coordinates are both greater than zero (0) and less than the prime defining the underlying field; and, 2) the x- and y-coordinates satisfy the equation for the curve and produce a valid point on the curve that is not the point at infinity. If either one of those conditions does not hold, the (x,y) pair is not a valid element. 🙅♀️
the scalar operation is addition of a point on the curve with itself a number of times. The point Y is multiplied x times to produce another point Z 🔁
Z = scalar-op(x, Y) = x*Ythe element operation is addition of two points on the curve. Points X and Y are summed to produce another point Z ➕
Z = element-op(X, Y) = X + Ythe inverse function is defined so the sum of an element and its inverse is "0", the point at infinity of an elliptic curve group 🌙
R + inverse(R) = "0"elliptic curve groups need a mapping function, q = F(Q), to convert a group element to an integer. The mapping function used in this memo returns the x-coordinate of the point it is passed 📍
scalar-op(x, Y) can be viewed as x iterations of element-op() by defining 🌀
Y = scalar-op(1, Y)
Y = scalar-op(x, Y) = element-op(Y, scalar-op(x-1, Y)), for x > 1a definition of how to add two points on an elliptic curve (i.e., element-op(X, Y)) can be found in [RFC6090] 📚
Note: There is another elliptic curve domain parameter, a cofactor, h, that is defined by the requirement that the size of the full elliptic curve group (including "0") be the product of h and q. Elliptic curve groups used with Dragonfly authentication MUST have a cofactor of one (1). 🚨
2.2. Finite Field Cryptography 💅
domain parameters for the FFC groups used in Dragonfly are:
- A prime, p, determining a prime field GF(p), the integers modulo p. The FFC group is a subgroup of GF(p)*, the multiplicative group of non-zero elements in GF(p). The group operation for FFC groups is multiplication modulo p. 🔢
- An element, G, in GF(p)* which serves as a generator for the FFC group. G is chosen such that its multiplicative order is a sufficiently large prime divisor of ((p-1)/2). 🌸
- A prime, q, which is the multiplicative order of G, and thus also the size of the cryptographic subgroup of GF(p)* that is generated by G. ✨
a number is a valid element in an FFC group if: 1) it is between one (1) and one (1) less than the prime, p, exclusive (i.e., 1 < element < p-1); and, 2) if modular exponentiation of the element by the group order, q, equals one (1). If either one of those conditions does not hold, the number is not a valid element. 🙅♀️
the scalar operation is exponentiation of a generator modulo a prime. An element Y is taken to the x-th power modulo the prime, returning another element, Z 💥
Z = scalar-op(x, Y) = Y^x mod pthe element operation is modular multiplication. Two elements, X and Y, are multiplied modulo the prime, returning another element, Z 🌷
Z = element-op(X, Y) = (X * Y) mod pthe inverse function for a MODP group is defined so the product of an element and its inverse modulo the group prime equals one (1). In other words 🦋
(R * inverse(R)) mod p = 13. The Dragonfly Key Exchange ✨
Okay bestie, so the Dragonfly exchange has two parties, named Alice and Bob for convenience (it's a convention, don't @ me 💅). They share a password that was set up out-of-band, and they both agree on one domain parameter set, either ECC or FFC 🫶. The main thing to know is that Alice and Bob have the exact same view of the password. It is NOT "augmented," so one side doesn't hold a password while the other holds a non-invertible verifier 🙈. That's what lets Dragonfly work in classic client-server protocols and in peer-to-peer apps where there are no fixed roles and either party can start the exchange (or both can do it at the same time) 🦋.
Before anything else, the two peers MUST derive a secret element in the chosen domain parameter set. Section 3.2 has two "hunting-and-pecking" techniques for this, one for ECC and one for FFC, but any secure, deterministic method that both sides agree on works too. For example, the technique in [hash2ec] can be used for ECC groups 🌸.
The Dragonfly exchange is made of two message exchanges. First there's the "Commit Exchange," where both sides commit to a single guess of the password. Then there's the "Confirm Exchange," where both sides confirm they actually know the password 🔥. The bonus is an authenticated, shared, and secret key, and how strong that key is depends on the agreed-upon group ✨.
Dragonfly uses a random function, H(), a mapping function, F(), and a key derivation function, KDF().
3.1. Assumptions
Okay, so to keep attackers from breaking Dragonfly, a few basic assumptions get made 🧚
- Function H is a "random oracle" (see [RANDOR]) that maps a binary string of indeterminate length onto a fixed binary string that is x bits long.
H: {0,1}^* --> {0,1}^x- Function F is a mapping function that takes an element in a group and returns an integer. For ECC groups, F() returns the x-coordinate of the element (which is a point on the elliptic curve). For FFC groups, F() is the identity function, since every element in an FFC group is already an integer less than the prime 💜.
ECC: x = F(P), where P=(x,y)
FFC: x = F(x)- Function KDF is a key derivation function (see, for instance, [SP800-108]). It takes a key to stretch, k, a label to bind to the key, label, and an indication of the desired output, n:
stretch = KDF-n(k, label)so that len(stretch) equals n.
- The discrete logarithm problem for the chosen group is hard. That means that given G, P, and Y = G^x mod p, it is computationally infeasible to determine x. Similarly, for an ECC group, given the curve definition, a generator G, and Y = x * G, it is computationally infeasible to determine x 🙌.
- There's a pool of passwords that the shared password gets drawn from. This pool can be made of words from a dictionary, for example. Every password in the pool has an equal chance of being the shared password, and all potential attackers have access to the pool 👀.
- The peers can produce quality random numbers 🎀.
3.2. Derivation of the Password Element
Before the exchange starts, the peers MUST derive a secret element, called the Password Element (PE), in the group defined by the chosen domain parameter set. From an attacker's point of view who doesn't know the password, the PE looks like a random element in the negotiated group 🦋. Two examples are described here for completeness, but any method that deterministically maps a secret string into an element of the selected group can be used. For instance, the technique in [hash2ec] works for ECC groups. If you use a different technique than the ones described here, the secret string SHOULD include the identities of the peers 🫶.
To fix the PE, both peers MUST have a common view of the password. If any password processing is needed (for example, to support internationalization), the processed password is what gets used as the shared credential. If either side wants to store a hashed version of the password (hashing the password with random data called a "salt"), it's necessary to send the salt to the other side before starting the exchange. The hashed password is then used as the shared credential 💅.
Note: Only one party would be able to maintain a salted password, and this would require that the Dragonfly key exchange be used in a protocol that has strict roles for client (which always initiates) and server (which always responds). Due to the symmetric nature of Dragonfly, salting passwords does not prevent an impersonation attack after compromise of a database of salted passwords. 💀
The deterministic process for selecting the PE starts with choosing a secret seed, and then doing a group-specific hunting-and-pecking technique. There's one for FFC groups and another for ECC groups 🔍.
To thwart side-channel attacks that try to figure out how many iterations of the hunting-and-pecking loop were used to find the PE for a given password, there's a security parameter, k. It makes sure that at least k iterations are always performed 🛡️. The probability that one needs more than n iterations of the hunting-and-pecking loop to find an ECC PE is roughly (q/2p)^n. To find an FFC PE, it's roughly (q/p)^n. Both of these rapidly approach zero (0) as n increases 📉. The security parameter, k, SHOULD be set large enough that the probability of finding the PE taking more than k iterations is sufficiently small (see Section 4) ✨.
First, an 8-bit counter is set to one (1). Then a secret base is computed using the negotiated one-way function with the identities of the two participants, Alice and Bob, the secret password, and the counter:
base = H(max(Alice,Bob) | min(Alice,Bob) | password | counter)The identities go into the max() and min() functions so the inputs to H() come out in a consistent order. This still allows a peer-to-peer exchange where both Alice and Bob each see themselves as the "initiator" 🙃.
Next, the base gets stretched using the technique from Section B.5.1 of [FIPS186-4]. The key derivation function, KDF, produces a bitstream whose length is the length of the prime from the group's domain parameter set plus the constant sixty-four (64). That's the temporary value, and then the temporary value gets modularly reduced to produce a seed 🧮:
n = len(p) + 64
temp = KDF-n(base, "Dragonfly Hunting and Pecking")
seed = (temp mod (p - 1)) + 1The string bound to the derived temporary value is for illustrative purposes only. Implementations of the Dragonfly key exchange SHOULD use a usage-specific label with the KDF 🎯.
Note: The base is stretched to 64 more bits than are needed so that the bias from the modular reduction is not so apparent. Big brain move 🧠.
The seed then gets passed to the group-specific hunting-and-pecking technique.
If the protocol running the Dragonfly exchange can exchange random nonces, those SHOULD be added to the computation of the base. That way every run of the protocol produces a different PE 🌈.
3.2.1. Hunting and Pecking with ECC Groups
The ECC-specific hunting-and-pecking technique loops until it finds a valid point on the elliptic curve. The seed is used as an x-coordinate with the curve equation to check whether x^3 + a*x + b is a quadratic residue modulo p. If it isn't, the counter gets incremented, a new base and a new seed are generated, and the hunting and pecking keeps going 🏃♀️. If it is a quadratic residue modulo p, then the x-coordinate is assigned the value of seed and the current base is stored. When the loop ends, the x-coordinate is used with the curve equation to solve for a y-coordinate. There's an ambiguity, though, because two values for the y-coordinate would be valid. The low-order bit of the stored base is used to unambiguously pick the correct y-coordinate 🔑. The resulting (x,y) pair becomes the Password Element, PE 👑.
Algorithmically, the process looks like this:
found = 0
counter = 1
n = len(p) + 64
do {
base = H(max(Alice,Bob) | min(Alice,Bob) | password | counter)
temp = KDF-n(base, "Dragonfly Hunting And Pecking")
seed = (temp mod (p - 1)) + 1
if ( (seed^3 + a*seed + b) is a quadratic residue mod p)
then
if ( found == 0 )
then
x = seed
save = base
found = 1
fi
fi
counter = counter + 1
} while ((found == 0) || (counter <= k))
y = sqrt(x^3 + ax + b)
if ( lsb(y) == lsb(save) )
then
PE = (x,y)
else
PE = (x,p-y)
fi
Figure 1: Fixing PE for ECC GroupsChecking whether a value is a quadratic residue modulo a prime can leak information about that value in a side-channel attack. 😱 So it is RECOMMENDED that the technique used to determine whether the value is a quadratic residue modulo p blinds the value with a random number. That way the blinded value can take on all numbers between 1 and p-1 with equal probability, and its quadratic residuosity doesn't change. The leak-resistant check works like this: flip a coin, then multiply the blinded value by either a random quadratic residue or a random quadratic nonresidue, and check whether the product is a quadratic residue (qr) or a quadratic nonresidue (qnr) modulo p, respectively. The random residue and nonresidue can be computed before hunting and pecking begins, by calculating the Legendre symbol on random values until they're found 🎲:
do {
qr = random() mod p
} while ( lgr(qr, p) != 1)
do {
qnr = random() mod p
} while ( lgr(qnr, p) != -1)Algorithmically, the masking technique for finding out whether or not a value is a quadratic residue looks like this:
is_quadratic_residue (val, p) {
r = (random() mod (p - 1)) + 1
num = (val * r * r) mod p
if ( lsb(r) == 1 )
num = (num * qr) mod p
if ( lgr(num, p) == 1)
then
return TRUE
fi
else
num = (num * qnr) mod p
if ( lgr(num, p) == -1)
then
return TRUE
fi
fi
return FALSE
}3.2.2. Hunting and Pecking with MODP Groups 🌸
okay so MODP groups do hunting and pecking a little differently 💅 You're looking for a random element that, when you use it as a generator, makes a group with the SAME order as the group the domain parameter set's generator makes 🦋 The secret generator comes from raising the seed to the power ((p-1)/q), where p is the prime and q is the order from the domain parameter set. If that value is bigger than one (1), it becomes the PE ✨ If it isn't, the counter goes up, a new base and seed get generated, and the hunting and pecking keeps going 🏹
Algorithmically, it looks like this 🧚
found = 0
counter = 1
n = len(p) + 64
do {
base = H(max(Alice,Bob) | min(Alice,Bob) | password | counter)
temp = KDF-n(seed, "Dragonfly Hunting And Pecking")
seed = (temp mod (p - 1)) + 1
temp = seed ^ ((p-1)/q) mod p
if (temp > 1)
then
if (not found)
PE = temp
found = 1
fi
fi
counter = counter + 1
} while ((found == 0) || (counter <= k))Figure 2: Fixing PE for MODP Groups
3.3. The Commit Exchange 💜
In the Commit Exchange, both sides commit to a single guess of the password 🔐 The peers generate a scalar and an element, swap them, and then process the other side's scalar and element to end up with a common, shared secret 🫶
First up, each peer generates two random numbers, private and mask, and each one has to be greater than one (1) and less than the order from the selected domain parameter set 🎀
1 < private < q
1 < mask < qNext, those two secrets plus the Password Element get mixed together to build the scalar and element 🧁
scalar = (private + mask) modulo q
Element = inverse(scalar-op(mask, PE))Now, if the scalar is less than two (2), the private and mask MUST be thrown away and new values generated 🙈 Once you've got a valid scalar and Element, the mask isn't needed anymore, so it MUST be irretrievably destroyed 💀
Time for the swap! The peers exchange their scalar and Element and check the peer's scalar and Element, which are called peer-scalar and Peer-Element. If the peer sent an identical scalar and Element (aka scalar equals peer-scalar and Element equals Peer-Element), it's a sign of a reflection attack, and the exchange MUST be aborted 🚨 If the values are different, then peer-scalar and Peer-Element must be validated 🔍 For the peer-scalar to be valid, it MUST be between 1 and q exclusive. Validating the Peer-Element depends on the cryptosystem: checking an (x,y) pair as an ECC element is specified in Section 2.1, and checking a number as an FFC element is specified in Section 2.2 ✨ If either the peer-scalar or Peer-Element fails validation, the exchange MUST be terminated and authentication fails 😭 But if both pass, they get used with the Password Element to derive a shared secret, ss, like this:
ss = F(scalar-op(private,
element-op(peer-Element,
scalar-op(peer-scalar, PE))))To keep things separated and cryptographically tidy 🧼, the shared secret gets stretched into two subkeys: a key confirmation key, kck, and a master key, mk. Each of the subkeys SHOULD be at least the length of the prime used in the selected group 💖
kck | mk = KDF-n(ss, "Dragonfly Key Derivation")where n = len(p)*2.
3.4. The Confirm Exchange 🦋
In the Confirm Exchange, both sides check that they derived the same secret, which means they both have the same password 👑
The Commit Exchange consists of an exchange of data that is the output of the random function, H(), the key confirmation key, and the two scalars and two elements exchanged in the Commit Exchange. The order goes like this: scalars before elements, and the sender's value before the recipient's value. So from each peer's perspective, it would generate:
confirm = H(kck | scalar | peer-scalar |
Element | Peer-Element | <sender-id>)Where <sender-id> is the identity of the sender of the confirm message. That identity SHALL be the one contributed by the sender of the confirm message when the base was generated in Section 3.2 🫶
The two peers swap these confirmations and verify the other peer's confirmation. If it's valid, authentication succeeds ✨ If it's not valid, authentication fails 💔
If authentication fails, all ephemeral state created during that particular run of the Dragonfly exchange MUST be irretrievably destroyed 🧹 If authentication doesn't fail, mk can be exported as an authenticated, secret key that another protocol (like IPsec) can use to protect other data 🔥
4. Security Considerations 🛡️
Okay, this part is SERIOUS bestie 😤 The Dragonfly exchange needs both participants to have an identical representation of the password. Salting the password just creates a new credential, the salted password, which has to be identically represented on both sides. If an adversary gets into the database of salted passwords, she could impersonate one side to the other, even if she couldn't work out the underlying, unsalted password 💀
Resistance to dictionary attack means an adversary has to launch an active attack to make a single guess at the password 🎯 If the dictionary the password came from has d entries, and each password in it has an equal chance of being chosen, then the chance of success after one guess is 1/d. After x guesses, and after failed guesses get removed from the pool of possible passwords, the chance becomes 1/(d-x). As x grows, so does the chance of success 📈 So yeah, it's possible for an adversary to figure out the password through repeated brute-force, active guessing attacks 😭 Users of the Dragonfly key exchange SHOULD make sure the pool the password was drawn from, d, is big enough to make this attack preventable 🫶 Implementations of Dragonfly SHOULD support countermeasures against this attack, like refusing authentication attempts for a certain amount of time once the number of failed attempts hits a certain threshold 🚫 No such threshold or amount of time is recommended in this memo.
Due to the problems with using groups that contain a small subgroup, it is RECOMMENDED that implementations of Dragonfly not allow the specification of a group's complete domain parameter to be sent in-line. Instead, they should use a common repository and pass an identifier to a domain parameter set whose strength has been rigorously proven and that doesn't have small subgroups 💅 If a group's complete domain parameter set is passed in-line, it SHOULD NOT be used with Dragonfly unless it directly matches a known good group.
It is RECOMMENDED that an implementation set the security parameter, k, to a value of at least forty (40), which puts the probability that more than forty iterations are needed in the order of one in one trillion (1:1,000,000,000,000) 🌈
The technique used to get the Password Element in Section 3.2.1 handles side-channel attacks in a way that some CFRG reviewers find controversial 🙈 An alternate method, like the one defined in [hash2ec], can help ease those concerns.
This key exchange protocol has been cryptanalyzed in [clarkehao] 🔍 [lanskro] gives a security proof of Dragonfly in the random oracle model, as long as both identities are included in the data sent in the Confirm Exchange (see Section 3.4) 👑
5. References 📚
5.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.5.2. Informative References
[clarkehao] Clarke, D. and F. Hao, "Cryptanalysis of the Dragonfly
Key Exchange Protocol", IET Information Security, Volume
8, Issue 6, DOI 10.1049/iet-ifs.2013.0081, November 2014.
[FIPS186-4] NIST, "Digital Signature Standard (DSS)", Federal
Information Processing Standard (FIPS) 186-4,
DOI 10.6028/NIST.FIPS.186-4, July 2013.
[hash2ec] Brier, E., Coron, J-S., Icart, T., Madore, D., Randriam,
H., and M. Tibouchi, "Efficient Indifferentiable Hashing
into Ordinary Elliptic Curves", Cryptology ePrint Archive
Report 2009/340, 2009.
[lanskro] Lancrenon, J. and M. Skrobot, "On the Provable Security
of the Dragonfly Protocol", Proceedings of 18th
International Information Security Conference (ISC
2015), pp 244-261, DOI 10.1007/978-3-319-23318-5_14,
September 2015.
[RANDOR] Bellare, M. and P. Rogaway, "Random Oracles are
Practical: A Paradigm for Designing Efficient Protocols",
Proceedings of the 1st ACM Conference on Computer and
Communication Security, ACM Press,
DOI 10.1145/168588.168596, 1993.
[RFC5433] Clancy, T. and H. Tschofenig, "Extensible Authentication
Protocol - Generalized Pre-Shared Key (EAP-GPSK) Method",
RFC 5433, DOI 10.17487/RFC5433, February 2009,
<http://www.rfc-editor.org/info/rfc5433>.
[RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental
Elliptic Curve Cryptography Algorithms", RFC 6090,
DOI 10.17487/RFC6090, February 2011,
<http://www.rfc-editor.org/info/rfc6090>.
[RFC7296] Kaufman, C., Hoffman, P., Nir, Y., Eronen, P., and T.
Kivinen, "Internet Key Exchange Protocol Version 2
(IKEv2)", STD 79, RFC 7296, DOI 10.17487/RFC7296, October
2014, <http://www.rfc-editor.org/info/rfc7296>.
[SP800-108] Chen, L., "Recommendation for Key Derivation Using
Pseudorandom Functions", NIST Special
Publication 800-108, October 2009.
[SP800-56A] Barker, E., Johnson, D., and M. Smid, "Recommendation for
Pair-Wise Key Establishment Schemes Using Discrete
Logarithm Cryptography (Revised)", NIST Special
Publication 800-56A, March 2007.Acknowledgements 🫶
The author would like to thank Kevin Igoe and David McGrew, the chairs of the Crypto Forum Research Group (CFRG), for agreeing to accept this memo as a CFRG work item 🥰 Extra thanks go to Scott Fluhrer and Hideyuki Suzuki for discovering attacks against earlier versions of this key exchange and suggesting fixes ✨ Lily Chen had helpful discussions on hashing into an elliptic curve 🧚 Rich Davis suggested the validation steps used on received elements to prevent a small subgroup attack 👑 Dylan Clarke and Feng Hao discovered a dictionary attack against Dragonfly if those checks aren't made and a group with a small subgroup is used 😱 And finally, a very heartfelt thanks to Jean Lancrenon and Marjan Skrobot for developing a proof of the security of Dragonfly 💖
The blinding scheme to prevent side-channel attacks when determining whether a value is a quadratic residue modulo a prime was suggested by Scott Fluhrer 🌈 Kevin Igoe suggested adding the security parameter k to hide the amount of time spent hunting and pecking for the password element 🦋
Author's Address 🎀
okay bestie, last stop! 💅 this is where you can reach the editor of this doc, Dan Harkins 🦋
Dan Harkins (editor)
Aruba Networks
1322 Crossman Avenue
Sunnyvale, CA 94089-1113
United States
Email: dharkins@arubanetworks.comand that's a wrap on RFC 7664 🌸✨ you made it through the whole thing, icon 👑
📦 where this page comes from
- ietf: rfc7664 2015-11
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms