Authentication and Key Management Automation in Decentralized Secure Email and Messaging via Low-Entropy Secrets Itzel Vazquez Sandoval∗, Arash Atashpendar∗†, Gabriele Lenzini∗ ∗SnT, University of Luxembourg †itrust consulting, Luxembourg Email: {itzel.vazquezsandoval,gabriele.lenzini}@uni.lu,
[email protected] Abstract—We revisit the problem of entity authentication in management, affecting email more acutely, is intertwined with decentralized end-to-end encrypted email and secure messaging authentication and the need for automating it has been known to propose a practical and self-sustaining cryptographic solution for a long time, e.g., see (Ruoti et al., 2018). based on password-authenticated key exchange (PAKE). This not only allows users to authenticate each other via shared low- Over the years, several methods have been established to entropy secrets, e.g., memorable words, without a public key tackle authentication, and indirectly key management: man- infrastructure or a trusted third party, but it also paves the ual validation, web of trust, public key infrastructure (PKI) way for automation and a series of cryptographic enhancements; and hierarchical validation, public key directories as well as improves security by minimizing the impact of human error and server-derived public keys such as identity-based encryption potentially improves usability. First, we study a few vulnera- bilities in voice-based out-of-band authentication, in particular (IBE). The set of viable candidates becomes much smaller a combinatorial attack against lazy users, which we analyze in once we consider a decentralized setting, i.e., without a PKI the context of a secure email solution. Next, we propose solving or a trusted third party (TTP).