[CFRG] Modifying SPAKE2 draft for more curves (was Re: Attack on a Real World SPAKE2 Implementation)

[Watson Ladd <[e-mail]>]

On Sun, May 9, 2021 at 12:06 PM Björn Haase <[e-mail]> wrote:
<snip>
> Regarding possible improvements of the draft I still would like to come up with a suggestion:

Thank you for the suggestion. Alas there are several procedural and
substantive reasons I don't think I'll be following it.

>
> What about adding a clear and *mandatory* specification for conforming implementations of SPAKE2 on any curve on how to generate the "nothing upon my sleeve" inputs M,N?
>
> I would recommend mandating a procedure that refers to the current draft version of the h2c draft as it is today.

Remember the M and N are computed offline, once. So hunt and peck
works, and is what we did for the M and N in the draft for the most
common curves of interest. Really there is just P256 and Ed25519 in
use.

Now, as for the h2c draft, the problem is that draft is far behind in
the process, and indeed didn't even exist when we began this work. I'd
prefer to not introduce an unnecessary dependency.  The other problem
is that then changes to the h2c draft would force changes, sometimes
big ones to this draft.

>
> Alternatively, if one would like to avoid references to the h2c draft (in order to make M,N independent of possible future changes in the h2c draft), one could consider using a specification in the style of appendix A in https://eprint.iacr.org/2018/286.pdf, where similar  "nothing upon my sleeve" points "A, C" were needed.

This draft has already passed through extensive review, including two
distinct examinations by the Experts Panel, a rather prolonged
post-last call process that discovered several unfortunate mistakes
(now corrected!) in test vector generation.

At this stage, with the draft in the IRTF chair queue, I am very
reluctant to make a change solely because it might be a good idea for
a small handful of people doing things on other curves. If there is a
genuine implementor need, a separate document can be advanced.

Sincerely,
Watson Ladd

-- 
Astra mortemque praestare gradatim