Re: [CFRG] Small subgroup question for draft-irtf-cfrg-hash-to-curve

[Björn Haase <[e-mail]>]

Dear Hao,

 

I would kindly request you in case that you actually really happen to question the security guarantees of the currently proposed CPace and OPAQUE designs as specified in the latest draft versions -- which does not actually happen to be the case after reading the last lengthy posts -- to clearly show up the aspects where the existing security analysis needs to be complemented/extended or corrected according to your assessment.

 

For CPace you find this analysis in https://eprint.iacr.org/2021/114 and this analysis covers all of: treatment of low-order points and identity elements produced by the map. I.e. both aspects that you seem to be concerned of have extensively been considered and the impact on the security bounds has been quantified.

 

Note that we explicitly spent the significant effort of incorporating all of the artifacts that could be generated by maps, hash2curve and encode2curve primitives in the above paper in tiny individual steps as to be able to facilitate review. IMO, it should be straight forward for you to pinpoint any aspect in the analysis that has not been correctly assessed in your opinion -- if there actually is any. This would also allow you to make more transparent at which point exactly you identify problems, a topic which is not clear to me even after reading your recent posts several times.

 

I think that structuring the discussion along the lines of the existing security analysis papers might help avoiding emotional discussion and might help to get things further in a more constructive way.

 

So far after reading all comments explicitly including yours I conclude that there happens to be consensus in that there is actually 1) neither a security problem with the current draft specifications for hash2curve nor 2) for OPAQUE and CPace regarding identity- and low-order points produced by the various maps, encode2curve constructions and hash2curve constructions as presented in the hash2curve draft.

 

Yours,

 

Björn.

 

P.S.: Please feel also free to contact me directly in order to speed-up discussions and resolve simple misunderstandings earlier. IMO this might also help for getting things further in a constructive way and could possibly avoid some unnecessary confusion of the other the readers on the list.