Password Authenticated Key Exchange

1. Password Authenticated Key Exchange Authors: Date: 2008-01-12 Dan Harkins, Aruba Networks

2. Abstract A key exchange authenticated with a password (which may be cryptographically weak) is presented. Dan Harkins, Aruba Networks

3. Pre-shared Key Authentication in 11s • Required for certain use cases. • Current proposal is unrealistic • Pre-shared key is assumed to be cryptographically strong • Pre-shared key is pairwise. • Pre-shared keys are deployed problematically for a reason • Pairwise keys doesn’t scale: give an administrator a choice between O(n) and O(1) s/he will choose the latter. • Pre-shared keys will be shared. Deployment experience shows that things will be used insecurely if that’s easier to deploy that way. • If n is a non-trivial amount (i.e. at least one-half dozen) the pre-shared key must be something that can be repeatedly entered with a low probability of errors– i.e. it probably won’t be cryptographically strong. • Pre-shared key is used directly in MSA 4-way handshake. Dan Harkins, Aruba Networks

4. This Poses Severe Problems in a Mesh • Using the pre-shared key (or key trivially derived from pre-shared key) with MSA authentication is susceptible to attack. • There are downloadable scripts available that can crack an 802.11i PSK in minutes! They could easily to the same for an 802.11s PSK • The attack in 11s is far worse than the attack in 11i • Attacking 802.11i PSK allows access to the network behind an AP for attackers within earshot of the AP. • Attacking 802.11s PSK would allow the mesh to grow unbounded to unauthorized MPs and clients • Successful attacks cause the mesh to grow, further increasing unauthorized traffic being sent onto the wired network behind the mesh. • the larger the mesh the more opportunity for more attackers to see the mesh and attack it. It’s a vicious downward spiral. Dan Harkins, Aruba Networks

5. Mesh is used in a warehouse It gets attacked, mesh grows when unauthorized mesh point authenticates with the PSK. Bigger mesh is visible to more people who attack it, further growing the mesh …and it keeps growing as it keeps getting attacked. Dan Harkins, Aruba Networks

6. How to Fix this Problem • We need to ensure mesh security regardless of deployment. • We need to ensure that the key used in the MSA 4-way handshake is unique and cryptographically strong. We cannot do that by issuing a fiat in the draft. • We need a way to turn a cryptographically weak, and possibly shared, pre-shared secret into a unique and cryptographically strong key. This technique must be: • Resistant to active attack • Resistant to passive attack • Resistant to dictionary attack • We need to ensure that the technique used to generate a cryptographically strong key is appropriate for mesh. • There cannot be any notion of an “initiator” and a “responder” • We need simultaneous authentication of equals Dan Harkins, Aruba Networks

7. Simultaneous Authentication of Equals • A protocol for authentication and key derivation using a, presumably weak, pre-shared secret • Initially both parties share: • Knowledge of identity of self and each other’s identity-- “Alice” and “Bob”. • A secret that need not be cryptographically strong– password. • A public ordering function, L, that returns the “greater” of two strings • A public random function, H • The definition of a finite cyclic group for which the discrete logarithm problem is known to be hard. For an elliptic curve group Ε, base point is G. (Notation: a point is uppercase, Q, and a scalar is lowercase, q). • A bijective function, f() that maps an element from the group to an integer. For an elliptic curve group, f() merely takes the x component of the point. • Upon completion: • Peers are authenticated • Peers share an authenticated (master) key that will be suitable for use with the MSA 4-way handshake. Dan Harkins, Aruba Networks

8. Simultaneous Authentication of Equals • if L(Alice, Bob) == Alice then • p = H(Alice | Bob | password) • else • p = H(Bob | Alice | password) Bob Alice • Choose random b • Compute V=b*G, v = f(V) • B = -(v*G), n = b*p + v*p • Choose random a • Compute U=a*G, u = f(U) • A = -(u*G), m = a*p + u*p m,A n,B • Compute K = a*(n*G + p*B) • = a*b*p*G • Compute k = f(K) • Compute x = H(k | A | m | B | n) • Compute K = b*(m*G + p*A) • = b*a*p*G • Compute k = f(K) • Compute y = H(k | B | n | A | m) x y • Verify y • Verify x Authenticated Master Key = H(k | f(A+B) | (n+m)mod r) Dan Harkins, Aruba Networks

9. Simultaneous Authentication of Equals • Attractive security properties • Perfect Forward Secrecy for keys. Key is authenticated in addition to the mesh points being authenticated. • Resistant to active attack, passive attack, and dictionary attack. • Uniquely appropriate for a mesh • No roles– initiator/responder or supplicant/authenticator • Either party can initiate first or both can initiate at the same time • Addresses numerous comments: 1345, 1614, 1615, 1616, 1622, 2975, 2980, 4750*, and 4758 • Security proof? I’m working on it. Hope to have something for the next meeting. * my personal favorite. Dan Harkins, Aruba Networks

10. Simultaneous Authentication of Equals • What’s the plan? • Socialize the idea within the 802.11s Working Group • Solicit input on how to most harmoniously incorporate this protocol into the 802.11s draft • Have some normative text ready for a motion very soon • Please come see me or email me: • If any of the PSK-related comments are your’s • If you think this is a good idea • If you think this is a bad idea • If you have crypto people at work who typically review standards please have them look at this and please send any comments to me. Dan Harkins, Aruba Networks