search

cfrg / draft-irtf-cfrg-opaque

The OPAQUE Asymmetric PAKE Protocol
https://cfrg.github.io/draft-irtf-cfrg-opaque/draft-irtf-cfrg-opaque.html
Other
100 stars 20 forks source link

Incorrect signature of function `Preamble` #418

Closed k13n closed 1 year ago

k13n commented 1 year ago

The signature of function Preamble in Section 6.4.2.1 is not aligned with its description nor its function body. The function has a parameter ke2 that's not used inside the function. Values credential_response, server_nonce, and server_public_keyshare are used in the function body, but are not passed in as parameters.

Currently the signature is Preamble(client_identity, ke1, server_identity, ke2), but it probably should be Preamble(client_identity, ke1, server_identity, credential_response, server_nonce, server_public_keyshare)

k13n commented 1 year ago

As I'm going through the algorithms I've spotted minor typos or things like that. What's the best way to report them? Just append them to this issue?

kevinlewi commented 1 year ago

Yep, feel free to append to this issue, or open multiple issues. Thanks!!

k13n commented 1 year ago

Ok thanks, here are some more tiny issues:

In function AuthServerRespond the value expected_client_mac is computed twice (I think the first line can be dropped):

expected_client_mac = MAC(Km3, Hash(concat(preamble, server_mac)))
state.expected_client_mac = MAC(Km3, Hash(concat(preamble, server_mac)))

In function AuthClientFinalize the value ke2.server_mac is used that doesn't exist, it should be ke2.auth_response.server_mac

In function GenerateKE3 the value server_public_key is returned from RecoverCredentials, but it's never used in GenerateKE3.

kevinlewi commented 1 year ago

Thanks for surfacing these -- we are really fortunate to have these caught!