Re: [Cfrg] I-D Action: draft-irtf-cfrg-spake2-08.txt

["Paterson Kenneth" <[e-mail]>]

Thanks for those clarifications - I should have read the new draft all the way through. I'll get to it in due course, and I hope others will too. 

-----Original Message-----
From: Greg Hudson <[e-mail]>
Date: Wednesday, 13 March 2019 at 15:45
To: Paterson  Kenneth <[e-mail]>, Benjamin Kaduk <[e-mail]>
Cc: "[e-mail]" <[e-mail]>, "[e-mail]" <[e-mail]>
Subject: Re: [Cfrg] I-D Action: draft-irtf-cfrg-spake2-08.txt

    On 3/13/19 11:01 AM, Paterson  Kenneth wrote:
    >     > 		page 3:  "B stores L=w1*g and w0." (In the context of SPAKE2+.)
    >     > 	-- Assuming g is the generator of G of order p*h, notice that this element L is not necessarily in the order p subgroup of G, since w1 (and w0) are not necessarily multiples of h.
    >     
    >     Since L is a multiple of G, it will be of order p (since G is of order
    >     p).  Unless I'm badly mistaken?
    >    
    > G is not of order p (at least that's how I read the spec.) - rather it has order hp.
    
    If g is the generator, then in the new terminology L=w1*P.  P is a point
    of order p, so L should have order p as well.

    
    > See Section 3.1:
    > 	Suppose G has order p*h where p is a large prime; h will be called the cofactor.
    
    That refers to the group.  (Having G refer to both the group and the
    generator is of course confusing, and was rightly rectified in -08.)
    
    The new draft defines "a generator P of the (large) prime-order subgroup
    of G".  In the old draft, it was not clear in the text that G (the
    generator point) was a point of order p, but for edwards25519 and
    edwards448 it used the standard generators for those groups, which are
    of order p.