Re: [Cfrg] Removing the magic constants from SPAKE2

On Wed, Jan 8, 2014 at 3:19 PM, Michael Hamburg <mike@shiftleft.org> wrote:
> Hello CFRG,
>
><snip>

> However, the protocol is considered problematic (and is out of favor with CFRG) in large part because of the magic curve points M,N.  The discrete logs of these points would be a backdoor in SPAKE2, so care must be taken to ensure that M,N are generated at random.
>
> However, there’s another way to do SPAKE2, which doesn’t need magic curve points.  Instead, M^hash(password) and N^hash(password) can be replaced with Elligator(hash(“M to the”, password)) and Elligator(hash(“N to the", password)).  This obviously achieves the same bounds in the ROM.

But it unfortunately falls apart in the standard model, because I can
cook the hash. The obvious choice for original SPAKE2 is the M and N
with smallest x or y coordinates that are on the curve besides the
generator. I don't think M&N are the issue here.

Basically, I think derandomization is better than SHA3 being like a
random oracle in all the ways that matter as an assumption.

>
><snip>
> Cheers,
> — Mike Hamburg
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin