RFC 8125

Requirements for Password-Authenticated Key Agreement (PAKE) Schemes 🎀

Okay so bestie, this is RFC 8125 🦋 and it's giving research-group energy. Here's the title block tea:

• Number and title: RFC 8125, Requirements for Password-Authenticated Key Agreement (PAKE) Schemes ✨
• Author: J. Schmidt, secunet Security Networks 💅
• Category: Informational (not a Standards Track spec, just published for info vibes) 🌸
• Date: April 2017 🍓
• Stream: Internet Research Task Force (IRTF) 👑
• ISSN: 2070-1721
• Obsoletes / Updates: nothing listed in this title block 🙈

It was made by the Crypto Forum Research Group (CFRG), so it's basically a consensus glow-up for PAKE designers. 🔥

Abstract ✨

Okay so PAKE schemes are interactive protocols where two participants authenticate each other AND derive shared cryptographic keys, using a (weaker) shared password 🔐. This doc reviews the different types of PAKE schemes, then lays out requirements and recommendations for anyone designing new ones. Literally a love letter to designers 💜. It's a product of the Crypto Forum Research Group (CFRG) 🫶.

Status of This Memo 🧚

This document is not an Internet Standards Track specification; it is published for informational purposes. 🌈

This document is a product of the Internet Research Task Force (IRTF). The IRTF publishes the results of Internet-related research and development activities. These results might not be suitable for deployment. This RFC represents the consensus of the Crypto Forum Research Group of the Internet Research Task Force (IRTF). Documents approved for publication by the IRSG are not a candidate for any level of Internet Standard; see Section 2 of RFC 7841. 💅

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at:

http://www.rfc-editor.org/info/rfc8125

Copyright Notice 💖

Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved. 🎀

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. 🦋

Table of Contents 🌸

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
2.  Requirements Notation . . . . . . . . . . . . . . . . . . . .   3
3.  PAKE Taxonomy . . . . . . . . . . . . . . . . . . . . . . . .   3
  3.1.  Storage of the Password . . . . . . . . . . . . . . . . .   3
  3.2.  Transmission of Public Keys . . . . . . . . . . . . . . .   4
  3.3.  Two Party versus Multiparty . . . . . . . . . . . . . . .   4
4.  Security of PAKEs . . . . . . . . . . . . . . . . . . . . . .   5
  4.1.  Implementation Aspects  . . . . . . . . . . . . . . . . .   6
  4.2.  Special Case: Elliptic Curves . . . . . . . . . . . . . .   6
5.  Protocol Considerations and Applications  . . . . . . . . . .   7
6.  Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . .   7
7.  Performance . . . . . . . . . . . . . . . . . . . . . . . . .   8
8.  Requirements  . . . . . . . . . . . . . . . . . . . . . . . .   8
9.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   9
10. Security Considerations . . . . . . . . . . . . . . . . . . .   9
11. References  . . . . . . . . . . . . . . . . . . . . . . . . .   9
  11.1.  Normative References . . . . . . . . . . . . . . . . . .   9
  11.2.  Informative References . . . . . . . . . . . . . . . . .   9
Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  10

1. Introduction 🦋

Okay so passwords are the predominant way people get into the Internet today, and it's all because they're intuitive and easy to use 💅. Since you're typing passwords over and over across tons of connections and apps, they tend to be easy to remember and easy to type without messing up 🙈. The catch? They're usually low-grade, not-so-random secrets that are super vulnerable to brute-force guessing attacks 💀.

Enter the PAKE (Password-Authenticated Key Exchange) 🔥. It's a cryptographic key exchange that does NOT send the password, or anything derived from it, across an unsecured channel. Two parties prove they both have the shared password without revealing it, so these exchanges are resistant to offline, brute-force dictionary attacks 👑. The idea was first described by Bellovin and Merritt in [BM92], and it's been getting serious cryptographic attention ever since ✨. PAKEs are especially iconic because they can achieve mutual authentication without needing any Public Key Infrastructure (PKI) 💜.

This document reviews different types of PAKE schemes. It defines requirements for new schemes and gives extra recommendations for PAKE designers. The specific recommendations are discussed throughout Sections 3-7, and Section 8 summarizes the requirements 🌈.

The requirements in this document were discussed with active members and represent the consensus of the Crypto Forum Research Group (CFRG) 🫶.

2. Requirements Notation 🎀

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 💅

3. PAKE Taxonomy 🧚

Okay so different PAKEs hit their goals in a bunch of common ways, and that leads to some design choices 🦋. Those are: how public keys get transmitted (encrypted or not), whether both parties hold the same representation of the password (balanced versus augmented), and how many parties are involved (two party versus multiparty) 🌸.

3.1. Storage of the Password 🍓

When both sides of a PAKE store the same representation of the password, the PAKE is called "balanced" ⭐. In a balanced PAKE, the password can be stored directly in a salted state, by hashing it with a random salt, or by representing the credential as an element in a finite field (for instance, multiplying a generator from a finite field by the password represented as a number to produce a "password element") 🔐. The benefit is that these PAKEs work when either party can start the exchange, or when both start at once, i.e., when they both think they're the "initiator" 👑. This sort of PAKE can be useful for mesh networking (see, for example, [DOT11]) or Internet of Things applications 🌈.

When one side keeps a transform of the password and the other keeps the raw password, the PAKE is called "augmented" 💖. Usually a client keeps the raw password (or some representation of it, like in the balanced case), and a server keeps a transformed element made with a one-way function ✨. The win with an augmented PAKE is that it protects the server's password in a way a balanced PAKE can't 🫶. Specifically, an adversary who successfully grabs the server's PAKE credentials can't directly use them to impersonate users to other servers 🙈. They'd have to learn the individual passwords first, e.g., by running an (offline) dictionary attack 💀. This sort of PAKE is useful for strict client-server protocols, such as the one discussed in [RFC5246] 🦋.

3.2. Transmission of Public Keys 💜

Every known PAKE uses public key cryptography 🔥. A big fundamental difference between PAKEs is how the public key gets communicated during the exchange 👑.

One class of PAKEs uses symmetric key cryptography, with a key derived from the password, to encrypt an ephemeral public key 🎀. The peer proves it successfully decrypted the public key, which proves it knows the shared password 💅. The first PAKE, the "Encrypted Key Exchange (EKE)", introduced in [BM92], is an example of this approach 🌸.

Another class of PAKEs sends unencrypted public keys, like the J-PAKE (Password Authenticated Key Exchange by Juggling) protocol [JPAKE] 🧚. During key agreement, ephemeral public keys and values derived from the shared password get exchanged 🦋. If the passwords match, both parties can compute a common secret by combining password, public keys, and private keys ✨. The SPEKE (Strong Password-Only Authenticated Key Exchange) [SPEKE] scheme also exchanges public keys, namely Diffie-Hellman values 🌈. Here, the generator for the public keys is derived from the shared secret 💖. After that, only the public Diffie-Hellman values are exchanged; the generator is kept secret 🫶. In both cases, the values sent over the unsecured medium are elements in a finite field, not a random blob 🙈.

A combo of EKE and SPEKE is used in PACE, as described in [BFK09], which is used in international travel documents, e.g., 🛂✈️. In this method, a nonce is encrypted rather than a key 💀. This nonce is used to generate a common base for the key agreement 🍓. Without knowing the password, the nonce can't be determined, so the subsequent key agreement will fail ⭐.

3.3. Two Party versus Multiparty 🌈

Okay so most PAKE protocols let two parties agree on a shared key based on a shared password 💅. That said, some proposals allow key agreement for more than two parties 👑. Those protocols let a group of parties establish keys, so they're called "Group PAKEs" or "GPAKEs" 🎀. Examples can be found in [ABCP06], while [ACGP11] and [HYCS15] propose a generic construction that transforms any two-party PAKE into a GPAKE protocol 🦋. Another way to define a multiparty PAKE is to assume a trusted server exists, with which each party shares a password 🧚. This server lets different parties agree on a common secret key without needing to share a password among themselves 💖. Each party only has a shared secret with the trusted server 🫶. For example, Abdalla et al. designed such a protocol, as discussed in [AFP05] 🌸.

---

Part 1 of 3 is done bestie 💜, so stay tuned for the next drop with Section 4 onwards 🦋✨.

4. Security of PAKEs 🔐✨

okay so PAKEs are built around this classic drama: Alice and Bob share a password (or Bob just holds a function of it 🫶) and they wanna set up a secure session key over a link that is totally untrusted. then there's Eve 💀, a powerful adversary who wants to ruin the vibe. she has a dictionary that's probably full of Alice and Bob's password, and she can brute-force her way through it one guess at a time.

every PAKE has one limitation, and it's a big one 😭 if Eve guesses the password, she can subvert the whole exchange. so the security question is basically: how likely is it that Eve gets the password? if her chances depend on actually talking to the protocol participants and not on how much computing power she has, then the PAKE is secure. like, Eve can't learn anything from a passive attack or from a single active attack. she can't just run through her dictionary offline, because every single guess would mean interacting with Alice or Bob. the only attack left is repeated guessing, and each active attack teaches her just one thing: whether her one guess was right or not. 🎯

so the whole security story of a PAKE rests on this: Eve, who is trying to impersonate Alice, can't efficiently check a password guess without talking to Bob (or Alice). and if she does talk to either of them, she gets caught 🚨 which is why it's a balancing act between limiting how many authentication attempts are allowed and not accidentally creating a denial-of-service vulnerability. 🙃

to judge and compare how secure PAKE schemes are, security proofs in commonly accepted models SHOULD be used. but here's the catch: every proof and model is built on assumptions. usually a proof shows that if an adversary could break the scheme, they could also solve some problem that's assumed to be hard, like computing a discrete logarithm. by conversion, breaking the scheme is then considered a hard problem too. it's giving logic chain 🧠

a PAKE scheme SHOULD be accompanied by a security proof with clearly stated assumptions and models used. the proof MUST show that the probability is negligible that an active adversary can pass authentication, learn extra information about the password, or learn anything about the established key. 💯 the authors MAY also specify which underlying primitives go with the scheme, or MAY consider specific use cases or assumptions, like resistance to quantum computers 🌈 a clear and comprehensive proof is literally the foundation for users to trust the scheme, so no shortcuts bestie 🫶

4.1. Implementation Aspects 🛠️

the theoretical security of a scheme is only part of the story. practical implementation pitfalls matter too 👀 even a scheme that's secure in a well-defined mathematical model can leak information through side channels if it's not carefully implemented. the design itself might make it easy or hard to protect against leaking info. in a network setting, an adversary can measure how long it takes to compute an answer and use that timing to figure out secret parameters of the scheme ⏱️ and if the device is running in a potentially hostile environment, like a smart card, you also have to think about power consumption, electromagnetic emanations, and even active implementation attacks 😱

the developers of a scheme SHOULD keep these implementation aspects in mind and show how to implement the protocol in constant time. adding a discussion about how to protect implementations of the scheme in potentially hostile environments is encouraged too 💖

4.2. Special Case: Elliptic Curves 📈

ECC is super popular because it gives you a smaller key length than traditional discrete-logarithm-in-finite-fields schemes at similar security levels 🔥 so people are definitely interested in using ECC for PAKE schemes. the twist is that, unlike schemes that can use a finite field element directly, some ECC-based schemes have an extra challenge: mapping a random string to an element you can actually compute with, like a point on the curve. sometimes you need the reverse too, mapping a curve point to a string that looks random and isn't distinguishable from one. when you pick a mapping, you have to think about the implementation side as well 🧩

if the PAKE scheme is meant to be used with ECC, the authors SHOULD state whether a mapping function is needed and, if it is, discuss its requirements. or, the authors MAY define a mapping to go with the scheme 🎀

5. Protocol Considerations and Applications 🧁

usually a PAKE is just a building block inside a bigger protocol, like IPsec or Transport Layer Security (TLS) 🧱 and that bigger picture can totally influence which PAKE scheme you pick. for example, an augmented scheme can be a great fit for protocols with a strict server-client relationship. but if both parties can start a connection, a balanced PAKE might be the better match 🤝

there's a special version of the network password problem called "Password-Authenticated Key Distribution," and [P1363] defines it as password-authenticated key retrieval: "The retrieval of a key from a secure key repository or escrow requiring authentication derived in part from a password."

then there's another variant: two parties exchanging public keys using a PAKE instead of certificates 🪪 in this setup, public keys can be encrypted with a password. authentication key distribution works because each side knows the private key tied to its unencrypted public key, and each side can also decrypt the peer's public key. this trick can turn a short, one-time code into a long-term public key, which is honestly iconic 👑

one more variant lets you combine authentication with certificates and passwords 🎭 here, the private key of the certificate is used to blind the password key agreement. for verification, the message gets unblinded with the public key. so a correct key establishment means the other side must hold the private key belonging to the certificate. this supports one-sided authentication, and also mutual authentication when the password is used 💜

the authors of a PAKE scheme MAY discuss variations of their scheme and explain the application scenarios where those variations are beneficial. techniques that allow long-term (public) key agreement are especially encouraged 🦋

6. Privacy 🙈

to set up a connection, each party in a PAKE needs to know who its communication partner is, so it can pick the right password for the agreement 🔑 when a user wants a secure channel with a server, the user first has to tell the server which password to use, by sending some kind of identifier. if that identifier isn't protected, anyone who can eavesdrop on the connection can figure out who the user is 😬 to prevent this and protect the user's privacy, the scheme might provide a way to protect transmission of the user's identity. a simple way to do it for a user talking to a server is to encrypt the user's identity using a public key the server provides 🔐

the PAKE scheme MAY discuss special ideas and solutions for protecting the privacy of the scheme's users. 🌸

7. Performance ⚡

how you judge a scheme's performance depends on what the target application cares about most 📊 potential metrics include latency, code size or area, power consumption, or the number of exchanged messages. there might also be scenarios where a constrained client talks to a powerful server 🪫 in that case the scheme has to need minimal effort on the client side. and for some clients, the computations might even run in hardware, which needs different optimizations than software does 🔧

the design of the scheme can also change how expensive it is to protect the implementation from adversaries who exploit its physical properties (see Section 4.1) 🛡️

the authors of a PAKE scheme MAY discuss their design choices and how those choices affect performance. the optimization goals could be stated in particular 🎯

8. Requirements 📋

this section sums up the requirements a PAKE scheme needs to be compliant with this document, based on the properties we talked about earlier ✅

• REQ1: A PAKE scheme MUST clearly state its features regarding balanced/augmented versions. 💅
• REQ2: A PAKE scheme SHOULD come with a security proof and clearly state its assumptions and models. 🔐
• REQ3: The authors SHOULD show how to protect their PAKE scheme implementation in hostile environments, particularly how to implement their scheme in constant time to prevent timing attacks. ⏱️
• REQ4: If the PAKE scheme is intended to be used with ECC, the authors SHOULD discuss their requirements for a potential mapping or define a mapping to be used with the scheme. 🧩
• REQ5: The authors of a PAKE scheme MAY discuss its design choice with regard to performance, i.e., its optimization goals. ⚡
• REQ6: The authors of a scheme MAY discuss variations of their scheme that allow use in special application scenarios. In particular, techniques that facilitate long-term (public) key agreement are encouraged. 🦋
• REQ7: Authors of a scheme MAY discuss special ideas and solutions on privacy protection of its users. 🙈
• REQ8: The authors MUST follow the IRTF IPR policy <https://irtf.org/ipr>. 👑

9. IANA Considerations 🌷

this document doesn't need any IANA actions, so nothing to register here 🙌

10. Security Considerations 🚨

okay this part is serious, bestie 😭 this document analyzes requirements for a cryptographic scheme, so security is the whole point. security considerations are discussed throughout the document, which honestly makes this whole thing a security considerations speedrun 🏃‍♀️💨 read the earlier sections carefully, because the security reasoning is spread all over them.

11. References 📚

11.1. Normative References 📖

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <http://www.rfc-editor.org/info/rfc2119>.

11.2. Informative References ✨

• [ABCP06] Abdalla, M., Bresson, E., Chevassut, O., and D. Pointcheval, "Password-Based Group Key Exchange in a Constant Number of Rounds", PKC 2006, LNCS 3958, DOI 10.1007/11745853_28, 2006.
• [ACGP11] Abdalla, M., Chevalier, C., Granboulan, L., and D. Pointcheval, "Contributory Password-Authenticated Group Key Exchange with Join Capability", CT-RSA 2011, LNCS 6558, DOI 10.1007/978-3-642-19074-2_11, 2011.
• [AFP05] Abdalla, M., Fouque, P., and D. Pointcheval, "Password-Based Authenticated Key Exchange in the Three-Party Setting", PKC 2005, LNCS 3386, DOI 10.1007/978-3-540-30580-4_6, 2005.
• [BFK09] Bender, J., Fischlin, M., and D. Kuegler, "Security Analysis of the PACE Key-Agreement Protocol", ISC 2009, LNCS 5735, DOI 10.1007/978-3-642-04474-8_3, 2009.
• [BM92] Bellovin, S. and M. Merritt, "Encrypted Key Exchange: Password-Based Protocols Secure against Dictionary Attacks", Proc. of the Symposium on Security and Privacy, Oakland, DOI 10.1109/RISP.1992.213269, 1992.
• [DOT11] IEEE, "IEEE Standard for Information technology--Telecommunications and information exchange between systems Local and metropolitan area networks--Specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications", IEEE 802.11, DOI 10.1109/IEEESTD.2016.7786995.
• [HYCS15] Hao, F., Yi, X., Chen, L., and S. Shahandashti, "The Fairy-Ring Dance: Password Authenticated Key Exchange in a Group", IoTPTS 2015, DOI 10.1145/2732209.2732212, 2015.
• [JPAKE] Hao, F. and P. Ryan, "Password Authenticated Key Exchange by Juggling", SP 2008, LNCS 6615, DOI 10.1007/978-3-642-22137-8_23, 2008.
• [P1363] IEEE Microprocessor Standards Committee, "Draft Standard Specifications for Password-Based Public Key Cryptographic Techniques", IEEE P1363.2, 2006.
• [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, DOI 10.17487/RFC5246, August 2008, <http://www.rfc-editor.org/info/rfc5246>.
• [SPEKE] Jablon, D., "Strong Password-Only Authenticated Key Exchange", ACM SIGCOMM Computer Communications Review, Volume 26, Issue 5, DOI 10.1145/242896.242897, October 1996.

---

Author's Address 🎀

Joern-Marc Schmidt
secunet Security Networks
Mergenthaler Allee 77
65760 Eschborn
Germany

Email: joern-marc.schmidt@secunet.com