## Cryptology ePrint Archive: Report 2021/696

The "quantum annoying" property of password-authenticated key exchange protocols

Edward Eaton and Douglas Stebila

Abstract: During the Crypto Forum Research Group (CFRG)'s standardization of password-authenticated key exchange (PAKE) protocols, a novel property emerged: a PAKE scheme is said to be quantum-annoying'' if a quantum computer can compromise the security of the scheme, but only by solving one discrete logarithm for each guess of a password. Considering that early quantum computers will likely take quite long to solve even a single discrete logarithm, a quantum-annoying PAKE, combined with a large password space, could delay the need for a post-quantum replacement by years, or even decades.

In this paper, we make the first steps towards formalizing the quantum-annoying property. We consider a classical adversary in an extension of the generic group model in which the adversary has access to an oracle that solves discrete logarithms. While this idealized model does not fully capture the range of operations available to an adversary with a general-purpose quantum computer, this model does allow us to quantify security in terms of the number of discrete logarithms solved. We apply this approach to the CPace protocol, a balanced PAKE advancing through the CFRG standardization process, and show that the CPaceBase variant is secure in the generic group model with a discrete logarithm oracle.

Category / Keywords: cryptographic protocols / password-authenticated key exchange, post-quantum, quantum-annoying, generic group model

Date: received 26 May 2021, last revised 26 May 2021

Contact author: eeaton at uwaterloo ca, dstebila@uwaterloo ca

Available format(s): PDF | BibTeX Citation

Short URL: ia.cr/2021/696

[ Cryptology ePrint archive ]