[Cfrg] A question to be added to the Round 2 questions list for nominated PAKEs (about SPAKE2)

["Stanislav V. Smyshlyaev" <[e-mail]>]

Dear CFRG,

I've just sent two questions to be considered to be added to the Round 2
questions list, including: "Can you propose a modification of SPAKE2
(preserving all existing good properties of SPAKE2) with a correspondingly
updated security proof, addressing the issue of a single discrete log
relationship necessary for the security of all sessions (e.g., solution
based on using M=hash2curve(A|B), N=hash2curve(B|A))?"

We've had a discussion with Dan Harkins about possible improvements of
SPAKE2 (many thanks to him for such a fruitful discussion!): it seems that
the only major issue about SPAKE2 can be solved by using M=hash2curve(A|B),
N=hash2curve(B|A)). It seems that there can't be any additional
side-channel issues (like occured in Dragonfly), since the proposed
modification needs only calculations based on publicly available
information.

Of course, such a modification requires additional security analysis of
SPAKE2, modified accordingly.

Best regards,
Stanislav