Re: [Cfrg] RGLC on draft-irtf-cfrg-spake2-13

["Hao, Feng" <[e-mail]>]

On Wed, Oct 14, 2020, 12:36 PM Hao, Feng <[e-mail]<mailto:[e-mail]>> wrote:
For “per-user M and N”, the authors need to be explicit how exactly will each party know the identity to be used by the other party even before any communication starts. Otherwise, you will end up with a “one-round PAKE” that can’t be implemented in one round.

This is a higher level protocol consideration, but I don't see how an extra round would be needed since the server seems the client identity in the first message. It has to look up the password after all.

How about the initiator? Besides client-server, you also need to consider peer-to-peer which is a typical setting for a balanced PAKE. How do peers know each other’s identity beforehand?

If you have specific text that would be helpful I'm happy to add it post collecting all the comments.

I’m afraid I don’t have any specific text to propose. It’s not about tweaking text. It’s a fundamental issue that needs to be considered carefully, especially that what you are doing here deviates from the established practice in the past many years research on PAKE where the user identities are established in-flow rather than being presumed or “remembered”. It’s OK that you do something different, but extra care is needed. I can only suggest you to flesh out full details on “per-user M and N” and how it is integrated within the SPAKE2 protocol as a complete specification before it’s possible for others to review and comment on your proposal; or alternatively revert to the original (published) SPAKE2 scheme and acknowledge the limitation of using a global trusted setup.