Re: [Cfrg] J-PAKE and Schnorr NIZK for informational RFCs

[Watson Ladd <[e-mail]>]

Dear Feng,

Let me make this very clear, to avoid your misunderstandings: J-PAKE
is substantially less efficient than SPAKE2 over the same group.
SPAKE2 with M and N generated by hashing is secure, and the proofs
found in the SPAKE2 paper do work for this case. If we use a small
subgroup of a finite field group, then the necessary validations for
group membership double the cost of SPAKE2, but J-PAKE is still
slower. J-PAKE requires an additional round, while SPAKE2 fits into
the same flow as Diffie-Hellman. There is no relevance of KOY, or
Jiang-Gong, or any other paper that may or may not (I didn't bother to
look) present its own definitions and security model.

SPAKE2 requires exactly 4 exponentations in the subgroup if we do not
do anything smart about them. Two of these can be combined and
replaced with a dual base exponentiation via Strauss's algorithm.

Do you have anything to say to this?

Sincerely,
Watson