Re: [Cfrg] I-D Action: draft-irtf-cfrg-augpake-02.txt

[SeongHan Shin <[e-mail]>]

Dear Ilari,

Thank you for your comments!

>"If the received X from user U is not a point on E or [2^n] * X = 0_E,"
>Should this be:
>If the received X from user U is not a point on E or [k] * X = 0_E,
>Similarly, there is:
>"If the received Y from server S is not a point on E or [2^n] * Y = 0_E,"
>Should this be:
>"If the received Y from server S is not a point on E or [k] * Y = 0_E,"
>
>Rationale:
>k is the cofactor, which may be ("optionally") power of two, it may
>not be 2^n.

In Appendix C, we set k = 2^n * q_1 * q_2 ...  q_t where n = {0,1,2} and
every primes q_i > q for i = 1, 2, ..., t (or optionally k = 2^n).
With this cofactor k, checking [2^n] * X =/ 0_E and [2^n] * Y =/ 0_E is
enough to exclude elements whose
group order is smaller than q. Now, X and Y are elements whose group order
is q or greater than q.

Of course, if k = 2^n * M where M is a composite integer whose factors are
< q,
the check should be [k] * X =/ 0_E and [k] * Y =/ 0_E as you recommended.


>Also:
>"The cofactor k is the value (#E / q) satisfying k = 2^n * q_1 * q_2
>...  q_t where n = {0,1,2} and every primes q_i > q for i = 1, 2,
>..., t."
>
>q_i are bigger than q? Isn't q usually chosen to be the biggest prime
>factor of #E?
As above, by using this cofactor k (or k = 2^n)
one can avoid the order check of elements received from the other party.


>Also, for some curves one might want to use (due to good performance
>and security), k=8.
I'll add this to the I-D.


Best regards,
Shin


On Thu, Aug 7, 2014 at 12:16 AM, Ilari Liusvaara <
[e-mail]> wrote:

> On Wed, Aug 06, 2014 at 07:12:08AM -0700, [e-mail] wrote:
> >
> > A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> >  This draft is a work item of the Crypto Forum Research Group Working
> Group of the IETF.
> >
> >         Title           : Augmented Password-Authenticated Key Exchange
> (AugPAKE)
> >         Authors         : SeongHan Shin
> >                           Kazukuni Kobara
> >       Filename        : draft-irtf-cfrg-augpake-02.txt
> >       Pages           : 20
> >       Date            : 2014-08-06
> >
> > There's also a htmlized version available at:
> > http://tools.ietf.org/html/draft-irtf-cfrg-augpake-02
> >
> > A diff from the previous version is available at:
> > http://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-augpake-02
>
> Did a quick read of changes:
>
> Appendix C:
>
> "If the received X from user U is not a point on E or [2^n] * X = 0_E,"
>
> Should this be:
>
> If the received X from user U is not a point on E or [k] * X = 0_E,
>
> Similarly, there is:
>
> "If the received Y from server S is not a point on E or [2^n] * Y = 0_E,"
>
> Should this be:
>
> "If the received Y from server S is not a point on E or [k] * Y = 0_E,"
>
>
> Rationale:
>
> k is the cofactor, which may be ("optionally") power of two, it may
> not be 2^n.
>
>
> Also:
>
> "The cofactor k is the value (#E / q) satisfying k = 2^n * q_1 * q_2
> ...  q_t where n = {0,1,2} and every primes q_i > q for i = 1, 2,
> ..., t."
>
> q_i are bigger than q? Isn't q usually chosen to be the biggest prime
> factor of #E?
>
> Also, for some curves one might want to use (due to good performance
> and security), k=8.
>
>
>
> -Ilari
>



-- 
------------------------------------------------------------------
SeongHan Shin
Research Institute for Secure Systems (RISEC),
National Institute of Advanced Industrial Science and Technology (AIST),
Central 2, 1-1-1, Umezono, Tsukuba City, Ibaraki 305-8568 Japan
Tel : [phone]
Fax : [phone]
E-mail : [e-mail]
------------------------------------------------------------------