3 ms·

Avoid: ... SRP, J-PAKE, ... Are there any recommended schemes for password-authenticated key exchange?

• tptacek 11y ago
  Don't do password-authenticated key exchange.
  • dfox 11y ago
    And what about zero-knowledge password proofs in general? (I tend to agree that PAKE is bad idea, but I'm not sure if my reasons are same as yours) In my opinion one should create encrypted channel essentially without any authentication and then do authentication inside of such channel, with ZKPP being one of the interesting ways of how to do that (with "plug password into scrypt and use the result as EdDSA secret key" being particularly straightforward solution), which obviously assumes that you have threat model where exposing password to server is meaningful security concern (usually it is not). I've seen many systems where ZKPP is the right thing to do (such systems usually involve offline operation with multiple users using same device), but their authors came up with some weird-ass construction with bunch of symmetric primitives that is anything but secure.
  • caf 11y ago
    Is it a corollary of this that at least one side of the connection must use a public key trusted somehow by the other side?
  • Tomte 11y ago
    I'm still looking forward to your SRP blog post!
  • nly 11y ago
    If you were so tasked, how would you go about replacing WPA2-PSK, while maintaining high usability, if not using a PAKE?