Re: [Cfrg] using hash2curve in a protocol

[Björn Haase <[e-mail]>]

Hello Dan,

> I want to fix a broken protocol. The protocol in question is EAP-pwd
> defined in RFC 5931. It does a "hunting and pecking loop" method
> of hashing to a curve that is similar, but worse, than the technique
> described in RFC 7664. (The method of obtaining a secret element in
> a MODP group is similarly broken). It is susceptible to side channel
> attack and I want to use the hash-to-curve draft to fix it.
I fully agree that preparing a constant-time path is the right thing to do.

I have had a short look at RFC 5931 and it looks to me as if this is a
construction explicitly designed for circumventing the EKE and SPEKE
patents. My first impression is that it is way more complex and less
efficient
than actually necessary. I think that one should be able to achieve the
same
objectives with less computations and and less flows?

Are there real-world applications around which are constrained to
use the algorithms of RFC 5931 or are you considering applications
that are newly to be developped?

For new algorithms I'd rather suggest to spend the effort and time for
writing a new RFC, e.g. based on a SPEKE- derivative with subsequent
explicit
key confirmation. This way one does not need the inversions and just two
scalar
multiplications per peer.

If this approach might be an option for you, I'd be willing to join
forces with writing.

Yours,

Björn.