Re:What We Do in the /etc./Shadow – Cryptography with Passwords
by Oreko on Saturday January 07, 2023 @10:18PM
(#34295665)
Turns out I misread part of the protocol.
I mixed up "b" stored by the server in the registration phase and the "b" used in the online phase. In that case, the adversary can't compute either b * C or c * B.
This being said, there's a more technical problem with the protocol as-is with how the OPRF is used. Currently, the adversary can malleate the OPRF messages resulting in a valid/invalid session between two honest parties without the simulator being able to distinguish between the two cases. This comes from the perfect blinding property of 2hDH and is discussed in the OPAQUE paper[1].
There may be other problems, but _most_ of the protocol passes a quick smell test.
I mixed up "b" stored by the server in the registration phase and the "b" used in the online phase. In that case, the adversary can't compute either b * C or c * B.
This being said, there's a more technical problem with the protocol as-is with how the OPRF is used. Currently, the adversary can malleate the OPRF messages resulting in a valid/invalid session between two honest parties without the simulator being able to distinguish between the two cases. This comes from the perfect blinding property of 2hDH and is discussed in the OPAQUE paper[1].
There may be other problems, but _most_ of the protocol passes a quick smell test.
Sorry for any confusion!