3 ms·
I'm in no way a cryptographer, so I don't understand the point of PAKE. The purpose is to build a secure channel between two entities, out of unsecure channels.
by rakoo 13y ago
I'm in no way a cryptographer, so I don't understand the point of PAKE. The purpose is to build a secure channel between two entities, out of unsecure channels. But PAKE needs the reliable transmission of a secret information, so a secure channel has to be made before AND that secret needs to remain secret (duh)... What is the functional advantage over good ol' certificates (which still need the first, but are far less restrictive about the second) ?
- brohee 13y agoThe typical usage I've seen is one entity controlling both ends of the communication (e.g. an IP camera and a server). The secret being provisioned at the installation of the system. I've never seen it used by humans, but there are contexts were the secure channel to establish the secret exists, e.g. most banks still have large brick and mortars infrastructures, so do tax authorities... SRP used to authenticate sites and users would make phishing as we know it obsolete, but it would have to be implemented very carefully in the browser so there is no way whatsoever for a website to mimic its password entry UI... But given the abysmal security record of the PKI model (were a few bad apple really ruin it for everyone else), the world could use a lot more SRP deployment...
- deleted 13y ago[deleted]
- kitd 13y agoWhat gets transmitted during key exchange is not the final symmetric key, but a kind of work-in-progress that both parties finish off to generate the final key, either by password, PK or any other method. No secure info is ever transmitted.