PhD Seminar • Cryptography, Security, and Privacy (CrySP) • The ‘Quantum Annoying’ Property of Password-Authenticated Key Exchange Protocols

Please note: This PhD seminar will be given online.

Edward Eaton, PhD candidate
David R. Cheriton School of Computer Science

Supervisor: Professor Douglas Stebila

During the Crypto Forum Research Group (CFRG)’s standardization of password-authenticated key exchange (PAKE) protocols, a novel property emerged: a PAKE scheme is said to be “quantum-annoying” if a quantum computer can compromise the security of the scheme, but only by solving one discrete logarithm for each guess of a password. Considering that early quantum computers will likely take quite long to solve even a single discrete logarithm, a quantum-annoying PAKE, combined with a large password space, could delay the need for a post-quantum replacement by years, or even decades.

In this talk, I will discuss the first steps towards formalizing the quantum-annoying property. We consider a classical adversary in an extension of the generic group model in which the adversary has access to an oracle that solves discrete logarithms. While this idealized model does not fully capture the range of operations available to an adversary with a general-purpose quantum computer, this model does allow us to quantify security in terms of the number of discrete logarithms solved. We apply this approach to the CPace protocol, a balanced PAKE advancing through the CFRG standardization process, and show that the CPaceBase variant is secure in the generic group model with a discrete logarithm oracle.

To join this PhD seminar on BigBlueButton, please go to https://bbb.crysp.org/b/ted-dnw-kg4.