warner / python-spake2 Goto Github PK

I'll start by just copying the magic-wormhole .appveyor.yml. Magic-wormhole passes on appveyor, so SPAKE2 must be working, but it'd be good to get real coverage.

The README says this library has no dependencies, whereas it actually has one on HKDF.

self.pw and self.pw_scalar are the "same". They need to be cryptographically different and not dependent on the other:

self.pw_scalar = params.group.password_to_scalar(hkdf(pw, "pw1"))
self.pw = hkdf(pw, "pw2")

This is especially true for the client-server augmentation of SPAKE2, PAKE2+.

self.pw_scalar = params.group.password_to_scalar(hkdf(pw, "pw1"))
self.pw = hkdf(pw, "pw2")
self.pw3 = params.group.password_to_scalar(hkdf(pw, "pw3"))

This repo uses an old version of Versioneer, which uses the SafeConfigParser deprecated in Python 3.2 and to be removed in 3.12.

• python/cpython#92503
• https://bugzilla.redhat.com/show_bug.cgi?id=2026354

Please update to the newest version of Versioneer for continued compatibility:

python -m pip install -U versioneer
versioneer install

• https://github.com/python-versioneer/python-versioneer#updating-versioneer

If you're using my old draft you should know it has a big mistake. SPAKE2 includes the password to be secure in concurrent settings. See http://www.di.ens.fr/~mabdalla/papers/AbPo05a-letter.pdf for details.

I've started work on this in the "pake2+" branch. The algorithm is defined in the last section of "The Twin Diffie-Hellman Problem and Applications" (Cash, Kiltz, Shoup), available at http://www.research.rutgers.edu/~dc789/dh.pdf :

• password (maybe after stretching) is split into two pieces, pw0 and pw1
• setup: server stores pw0 and L=B*pw1
• client: pick random scalar x, send element X = B*x + U*pw0
• server: pick random scalar y, send element Y = B*y + V*pw0
• server: compute element Z = (X-U*pw0)*y
• server: compute element N = L*y
• server: compute shared key as hash(pw0, X, Y, Z, N)
• client: compute element Z = (Y-V*pw0)*x
• client: compute element N = (Y-V*pw0)*pw1
• client: compute shared key as hash(pw0, X, Y, Z, N)

A server compromise doesn't immediately reveal a password-equivalent, because the server stores B*pw1 instead of pw1, so the attacker must first run an offline dictionary attack to reverse the scalarmult.

Relative to (symmetric) SPAKE2, this just adds the N term and server-side storage for L.