1. Password Authenticated Key Exchange
January 2008
doc.: IEEE /0045r1
January 2008
Password Authenticated Key Exchange
Date:
Authors:
Dan Harkins, Aruba Networks
Dan Harkins, Aruba Networks

2. January 2008
doc.: IEEE /0045r1
January 2008
Abstract
A key exchange authenticated with a password (which may be cryptographically weak) is presented.
Dan Harkins, Aruba Networks
Dan Harkins, Aruba Networks

3. Pre-shared Key Authentication in 11s
January 2008
Pre-shared Key Authentication in 11s
Required for certain use cases.
Current proposal is unrealistic
Pre-shared key is assumed to be cryptographically strong
Pre-shared key is pairwise.
Pre-shared keys are deployed problematically for a reason
Pairwise keys doesn’t scale: give an administrator a choice between O(n) and O(1) s/he will choose the latter.
Pre-shared keys will be shared. Experience shows that things will be used insecurely if that’s easier to deploy that way.
If n is a non-trivial amount (i.e. at least one-half dozen) the pre-shared key must be something that can be repeatedly entered with a low probability of errors– i.e. it probably won’t be cryptographically strong.
Design of Key Hierarchy assumes root key is unique
Sharing of pre-shared keys voids a fundamental security assumption
The pre-shared key is used directly in the MSA 4-way handshake
Dan Harkins, Aruba Networks

4. This Poses Severe Problems in a Mesh
January 2008
This Poses Severe Problems in a Mesh
Using the pre-shared key (or key trivially derived from pre-shared key) with MSA authentication is susceptible to attack.
There are downloadable scripts available that can crack an i PSK in minutes! They could easily to the same for an s PSK
The attack in 11s is far worse than the attack in 11i
Attacking i PSK allows access to the network behind an AP for attackers within earshot of the AP.
Attacking s PSK would allow the mesh to grow unbounded to unauthorized MPs and clients
Successful attacks cause the mesh to grow, further increasing unauthorized traffic being sent onto the wired network behind the mesh.
the larger the mesh the more opportunity for more attackers to see the mesh and attack it. It’s a vicious downward spiral.
Uniqueness of mesh makes pre-shared key usage problematic
A mesh introduces more opportunities for attack (more MPs!) than an infrastructure network
Successful attack of one node compromises the mesh allows for exposure of prior traffic sent to/from the compromised MP and forgery of traffic to/from the compromised MP.
Dan Harkins, Aruba Networks

5. January 2008 Mesh is used in a warehouse It gets attacked, mesh grows
when unauthorized mesh point
authenticates with the PSK.
Bigger mesh is visible
to more people who attack
it, further growing the mesh
…and it keeps growing as it
keeps getting attacked.
Dan Harkins, Aruba Networks

6. January 2008
How to Fix this Problem
We need to ensure mesh security regardless of deployment.
We need to ensure that the key used in the MSA 4-way handshake is unique and cryptographically strong. We cannot do that by issuing a fiat in the draft.
We need a way to turn a cryptographically weak, and possibly shared, pre-shared secret into a unique and cryptographically strong key. This technique must be:
Resistant to active attack
Resistant to passive attack
Resistant to dictionary attack
We need to ensure that the technique used to generate a cryptographically strong key is appropriate for mesh.
There cannot be any notion of an “initiator” and a “responder”
We need simultaneous authentication of equals
Dan Harkins, Aruba Networks

7. Simultaneous Authentication of Equals
January 2008
Simultaneous Authentication of Equals
A protocol for authentication and key derivation using a, presumably weak, pre-shared secret
Initially both parties share:
Knowledge of identity of self and each other’s identity-- “Alice” and “Bob”.
A secret that need not be cryptographically strong– password.
A public ordering function, L, that returns the “greater” of two strings
A public random function, H
The definition of a finite cyclic group. For an elliptic curve group Ε, base point is G, order is r. (Notation: a point is uppercase, Q, and a scalar is lowercase, q).
A bijective function, f() that maps an element from the group to an integer. For an elliptic curve group, f() merely takes the x component of the point.
Upon completion:
Peers are authenticated
Peers share an authenticated (master) key that will be suitable for use with the MSA 4-way handshake.
Dan Harkins, Aruba Networks

8. Simultaneous Authentication of Equals
January 2008
Simultaneous Authentication of Equals
Assumptions
Function H is a “random oracle”. An adversary is given access to a black box which upon input of data known to the adversary returns either random bits or the output of H. The adversary is unable to distinguish between the two and any advantage the adversary can gain is negligible and is solely through repeated interaction with the black box.
For H: {0,1}*  {0,1}k each of the 2k possible outputs has an equal probability of being the output for some input.
H is one-way. Given y = H(x) it is infeasible to determine x.
The finite cyclic group is one for which the discrete logarithm problem is hard: given y = gx for some element of the group (the generator) g, it is infeasible to determine x. Equivalently for an elliptic curve group, given Y = x*G for some point on the curve (the generator) G, it is infeasible to determine x.
Dan Harkins, Aruba Networks

9. Simultaneous Authentication of Equals
January 2008
Simultaneous Authentication of Equals
if L(Alice, Bob) == Alice then
p = H(Alice | Bob | password)
else
p = H(Bob | Alice | password)
Alice
Bob
Choose random a
Compute U=a*G, u = f(U)
A = -(u*G), m = a*p + u*p
Choose random b
Compute V=b*G, v = f(V)
B = -(v*G), n = b*p + v*p
m,A n,B
Compute K = a*(n*G + p*B)
= a*b*p*G
Compute k = f(K)
Compute x = H(k | A | m | B | n)
Compute K = b*(m*G + p*A)
= b*a*p*G
Compute k = f(K)
Compute y = H(k | B | n | A | m)
x y
Verify y
Verify x
Authenticated Master Key = H(k | f(A+B) | (n+m)mod r)
Dan Harkins, Aruba Networks

10. Simultaneous Authentication of Equals
January 2008
Simultaneous Authentication of Equals
Alice
Bob
Peer-to-peer protocol, not lock-step
No notion of “initiator” and “responder”; “supplicant” and “authenticator” or “client” and “server”.
Initial messages are not dependent on each other; final messages are dependent on initial messages, not each other.
Each side can “initiate” or both can “initiate” simultaneously and the resulting protocol instances are identical
Alice initiates
first
Bob initiates
first
Both initiate
simultaneously
Dan Harkins, Aruba Networks

11. Simultaneous Authentication of Equals
January 2008
Simultaneous Authentication of Equals
Attractive security properties
Perfect Forward Secrecy for keys. Key is authenticated in addition to the mesh points being authenticated.
Resistant to active attack, passive attack, and dictionary attack.
Uniquely appropriate for a mesh
No roles– initiator/responder or supplicant/authenticator
Either party can initiate first or both can initiate at the same time
Addresses numerous comments: 1345, 1614, 1615, 1616, 1622, 2975, 2980, 4750*, and 4758
Security proof? I’m working on it. Hope to have something for the next meeting.
* my personal favorite.
Dan Harkins, Aruba Networks

12. password authenticated
January 2008
How to Fix this Problem
pre-shared key
Authentication Server
(IEEE 802.1X Authentication only)
cryptographically weak
password authenticated
key exchange
cryptographically
strong
cryptographically strong
Mesh Key Distributor
Mesh Authenticator A
Derives PTK-A
Mesh Authenticator B
Derives PTK-B
Dan Harkins, Aruba Networks

13. Simultaneous Authentication of Equals
January 2008
Simultaneous Authentication of Equals
What’s the plan?
Socialize the idea within the s Working Group
Solicit input on how to most harmoniously incorporate this protocol into the s draft
Have some normative text ready for a motion very soon
Please come see me or me:
If any of the PSK-related comments are your’s
If you think this is a good idea
If you think this is a bad idea
If you have crypto people at work who typically review standards please have them look at this and please send any comments to me.
Dan Harkins, Aruba Networks