Re: [Cfrg] I-D Action: draft-irtf-cfrg-spake2-08.txt

[Greg Hudson <[e-mail]>]

* The old version of the draft uses secret coefficients which are
multiples of the cofactor h, similar to X25519, in order to ensure that
the computed point K is in the prime-order subgroup generated by P.  The
new version of the draft instead asks each party to check the other
party's public point order by checking if h*S=I or h*T=I.  This seems
less efficient, and I also don't think it is correct.  It would catch
points of small order (h or factors of h), but not points of order 2p,
4p, ..., hp.  Why the change?

* "[K] MUST NOT be used as a shared secret" is a weird statement, as we
go on to describe how to use it as a shared secret in key derivation.
Perhaps, "MUST NOT be directly used as a cryptographic key".

* This revision includes allowances for omitting one or the other
identity from key derivation.  I think this departs from the SPAKE2
security proof, and I don't recall discussion here about relaxing that
requirement.

* scrypt seems like an outdated choice of memory-hard hash function.

* I know what a MAC address is, but had to google what a Media Access
Control address is.  (Only in hindsight are they obviously the same thing.)

* "w0s and w1s MUST NOT equal I" seems not well-formed, as they seem to
be numbers, not group elements.  If they are instead to be checked
against 0 and/or 1, I think this needs a justification; it is
vanishingly unlikely to happen by chance (and an attacker is not in
control of the password); an attacker who just passively waits to spot
this case would be equally likely to succeed by passively waiting for
some other specific value.

* Typo: "protocl".

As the draft now more specifically constrains key derivation and key
confirmation (presumably in response to Kenny Paterson's feedback), I
think it can no longer be used as a normative reference for
draft-ietf-kitten-spake-preauth.  That is probably not an overriding
concern.