Cryptology ePrint Archive: Report 2021/873

KHAPE: Asymmetric PAKE from Key-Hiding Key Exchange

Yanqi Gu and Stanislaw Jarecki and Hugo Krawczyk

Abstract: OPAQUE [Jarecki et al., Eurocrypt 2018] is an asymmetric password authenticated key exchange (aPAKE) protocol that is being developed as an Internet standard and for use within TLS 1.3. OPAQUE combines an Oblivious PRF (OPRF) with an authenticated key exchange to provide strong security properties, including security against pre-computation attacks (called saPAKE security). However, the security of OPAQUE relies crucially on the security of the OPRF. If the latter breaks (by cryptanalysis, quantum attacks or security compromise), the user's password is exposed to an offline dictionary attack. To address this weakness, we present KHAPE, a variant of OPAQUE that does not require the use of an OPRF to achieve aPAKE security, resulting in improved resilience and near-optimal computational performance. An OPRF can be optionally added to KHAPE, for enhanced saPAKE security, but without opening the password to an offline dictionary attack upon OPRF compromise.

In addition to resilience to OPRF compromise, a DH-based implementation of KHAPE (using HMQV) offers the best performance among aPAKE protocols in terms of exponentiations with less than the cost of an exponentiation on top of an UNauthenticated Diffie-Hellman exchange. KHAPE uses three messages if the server initiates the exchange or four when the client does (one more than OPAQUE in the latter case).

All results in the paper are proven within the UC framework in the ideal cipher model. Of independent interest is our treatment of key-hiding AKE which KHAPE uses as a main component as well as our UC proofs of AKE security for protocols 3DH (a basis of Signal), HMQV and SKEME, that we use as efficient instantiations of KHAPE.

Category / Keywords: cryptographic protocols / password protocols, pake

Original Publication (with major differences): IACR-CRYPTO-2021

Date: received 24 Jun 2021

Contact author: yanqig1 at uci edu, stasio at ics uci edu, hugokraw at gmail com

Available format(s): PDF | BibTeX Citation

Version: 20210629:114054 (All versions of this report)

Short URL: ia.cr/2021/873


[ Cryptology ePrint archive ]