0x10: klondike - PaTo: Server-aided cryptographic transformation of passwords into tokens

### Overview In this lightning talk, the speaker introduces PaTo, an academic cryptographic protocol designed to convert passwords into tokens to solve client-side password storage problems. Standard password authentication remains vulnerable to credential reuse, leaks, and client compromise. PaTo aims to offer the security properties of a cryptographic token without requiring a complete redesign of server-side authentication architectures.

### Key Topics - **Client-Side Password Storage Limitations**: Existing client-side protection approaches include symmetric encryption (e.g., KeePass, TPMs), hash-based storage, or secret sharing across multiple servers. However, when an endpoint is compromised by an attacker (such as in APT scenarios), attackers can observe passwords in plaintext as they are submitted to browsers or intercept reconstructed secrets, enabling lateral movement and cross-service impersonation. - **Cryptographic Objectives**: Moving toward public-key style password encapsulation requires addressing key security properties: 1. *Correctness*: Ensuring the original password is accurately decrypted. 2. *Indistinguishability*: Preventing an adversary with a dictionary containing the candidate password from determining which plaintext was encrypted. 3. *Length Obfuscation*: Eliminating metadata leakage from password character lengths, which would otherwise allow attackers to narrow down candidate passwords. 4. *Authenticated Encryption*: Ensuring the integrity and authenticity of the encrypted credential payload.

### Technical Details - **Box Algorithm Construction**: PaTo implements a cryptographic "box" construct utilizing ephemeral Diffie-Hellman. While originally envisioned with Supersingular Isogeny Diffie-Hellman (SIDH) for post-quantum security, SIDH was broken by classical cryptanalysis, leaving the construction reliant on standard classical ephemeral Diffie-Hellman. - **Primitives & Operations**: Key material is extracted using a hash-based algorithm. Indistinguishability is achieved via fresh ephemeral Diffie-Hellman keys per encryption. Correctness and authenticated encryption are enforced using AES in Synthetic Initialization Vector (AES-SIV) mode. Length obfuscation is implemented via padding and hashing (or client-side hashing). - **Protocol Extensions & Deployment**: - *Additional Binding Data*: Allows embedding token-like properties, such as expiration timestamps verified by the server. - *Key Rolling*: Enables updating credentials by returning new encrypted passwords; the client updates stored values only after verifying the new password functions correctly, mitigating denial-of-service risks. - *Proxy Architecture*: PaTo can be deployed as an inline proxy without rewriting legacy backend authentication systems (e.g., industrial IoT systems running Windows 98). The proxy holds the private key, decrypts incoming PaTo tokens, and forwards standard plaintext credentials to the backend. - **Security Proof**: Security is modeled using an indistinguishability under chosen-plaintext attack (IND-CPA) game. By reducing an adversary capable of breaking the PaTo game to an adversary breaking IND-CPA on the underlying box function, the protocol is proven as secure as the box primitive.

### Takeaways PaTo demonstrates that client-side credentials can achieve the security guarantees of tokens through public-key encryption and authenticated primitives, while supporting drop-in backwards compatibility with legacy authentication servers using a decryption proxy.