Re: [Cfrg] A question to be added to the Round 2 questions list for nominated PAKEs (about SPAKE2)

["Scott Fluhrer (sfluhrer)" <[e-mail]>]

The issue I foresee in a hash-to-curve method is that SPAKE2 attempts to use a number of different curves (P256, Curve25519), and these curves have different hash2curve algorithms.

Do we restrict the curves supported?  Do we use different hash2curve algorithms for different curves?  Do we try to use a single hash2curve algorithm that attempts to supports all the curves (possibly suboptimially)?

From: Cfrg <[e-mail]> On Behalf Of Stanislav V. Smyshlyaev
Sent: Wednesday, November 20, 2019 2:43 AM
To: CFRG <[e-mail]>
Subject: [Cfrg] A question to be added to the Round 2 questions list for nominated PAKEs (about SPAKE2)

Dear CFRG,

I've just sent two questions to be considered to be added to the Round 2 questions list, including: "Can you propose a modification of SPAKE2 (preserving all existing good properties of SPAKE2) with a correspondingly updated security proof, addressing the issue of a single discrete log relationship necessary for the security of all sessions (e.g., solution based on using M=hash2curve(A|B), N=hash2curve(B|A))?"

We've had a discussion with Dan Harkins about possible improvements of SPAKE2 (many thanks to him for such a fruitful discussion!): it seems that the only major issue about SPAKE2 can be solved by using M=hash2curve(A|B), N=hash2curve(B|A)). It seems that there can't be any additional side-channel issues (like occured in Dragonfly), since the proposed modification needs only calculations based on publicly available information.

Of course, such a modification requires additional security analysis of SPAKE2, modified accordingly.

Best regards,
Stanislav