[Cfrg] Balanced PAKEs: new paper on SPAKE2

[Karthik Bhargavan <[e-mail]>]

Hello All,

Michel Abdalla and Manuel Barbosa have just published a new paper the perfect forward security of SPAKE2: https://eprint.iacr.org/2019/1194

They say:
"In this version, we tried to address some of the issues that were raised in the CFRG mailing list and during our meeting. 
 
In particular, the proof handles explicitly the case M=N. The cases where M and N are chosen as the output of a random oracle also follows from the proof. This means for instance that M and N could be set the hash of two fixed points (or one point when M=N) or set as a function of the client and server, such as M=H(C,S) (where H is a hash-to-group function.)

The goal of the paper was not to compare it with the other submissions. It was simply to improve the security analysis of SPAKE2 and its possible variants”

With these new results in mind, I would recommend that the SPAKE2 draft use a connection-specific M=N=H(C,S,...) generated using hash-to-curve.
This will make the precomputation attack on SPAKE2 less worrisome.

Best regards,
Karthik