1. The PAK proposal for sacred WG Alec Brusilovsky abrusilovsky@lucent.com

2. Wednesday, August 3, 2005 2 Sacred WG IETF 63, Paris, France Wish list  Mutual authentication based on just a pre-shared, human-memorizable password.  Fulfillment of the need to guard against a man-in-the- middle and against offline dictionary attack.  Simplicity and openness, to promote widespread adoption and to minimize flaws.  PAK (Password Authenticated Key exchange) –satisfies all of the above –is proposed as a new work item for sacred

3. Wednesday, August 3, 2005 3 Sacred WG IETF 63, Paris, France Why PAK?  Provides strong key exchange with weak passwords  Foils the man-in-the-middle attack  Provides explicit mutual authentication

4. Wednesday, August 3, 2005 4 Sacred WG IETF 63, Paris, France Diffie-Hellman Key Exchange (1976) a refresher Alice Bob Global public: x and y – primes y < x Alice’s Key generation: Select private Ra; Ra < x Calculate public y Ra mod x Bob’s Key generation: Select private Rb; Rb < x Calculate public y Ra mod x Alice’s Key = Bob’s Key (y Ra ) Rb mod x = (y Rb ) Ra mod x K=(y Rb ) Ra mod xK=(y Ra ) Rb mod x y Ra mod x y Rb mod x

5. Wednesday, August 3, 2005 5 Sacred WG IETF 63, Paris, France PAK – an extension of the Diffie-Hellman Key Exchange Alice Bob Global public: x and y – primes, y < x K=(y Rb ) Ra mod xK=(y Ra ) Rb mod x y Ra mod x y Rb mod x K=HASH’’(PW, y Rb*Ra mod x ) HASH(PW) * y Ra mod x HASH’(PW) * y Rb mod x Alice and Bob share password PW

6. Wednesday, August 3, 2005 6 Sacred WG IETF 63, Paris, France PAK – Password Authenticated Key Exchange Protocol (details omitted) Alice Bob K=HASH(3,PW, y RbRa mod x)K=HASH(3,PW, y RaRb mod x) HASH(PW) * (y Ra mod x) HASH(PW) * (y Rb mod x), S 1 Alice and Bob share password PW S2S2 S 2 = HASH(2, PW, y Rb mod x, y Ra mod x, y RaRb mod x) S 1 = HASH(1, PW, y Ra mod x, y Rb mod x, y RaRb mod x) K=HASH(3,PW, y RbRa mod x) K=HASH(3,PW, y RaRb mod x)

7. Wednesday, August 3, 2005 7 Sacred WG IETF 63, Paris, France Plan9 – implementation of PAK  Plan 9 is distributed in an open source manner: http://plan9.bell-labs.com/plan9dist/license.html  The particular algorithm used in Plan 9 is PAK. PAK is a seemingly obvious tweak to Diffie-Hellman  To download plan 9 go to: http://plan9.bell-labs.com/plan9dist/download.html

8. Thank you Alec Brusilovsky abrusilovsky@lucent.com