Re: [Cfrg] using hash2curve in a protocol

   Hi Mathy,

On 8/10/19 8:57 AM, Mathy Vanhoef wrote:
> I echo the advice that using an existing PAKE is likely the most
> secure option, since these are more well-studied,

   It is an existing PAKE.

> Because similar changes are also being proposed in an update to the
> Wi-Fi standard, one remark is that in the simplified_swu and
> hash_to_ffc routine you can use PBKDF2 or similar instead of HKDF.
> This will make possible brute-force attacks (e.g. due to
> implementation issues or other side-channels) more costly. Since these
> routines only have to be executed when configuring the password, and
> not in every run of the handshake, the added overhead should be
> manageable.

   This is actually more of a comment for the hash-to-curve I-D. I'm
just going to use the techniques defined in that (soon to be) RFC.

   regards,

   Dan.

> Best,
> Mathy
>
> On Thu, Jul 25, 2019 at 3:20 PM Watson Ladd <watsonbladd@gmail.com> wrote:
>> On Wed, Jul 24, 2019 at 11:05 AM Dan Harkins <dharkins@lounge.org> wrote:
>>>
>>>     Hello,
>>>
>>>     The hash-to-curve draft is still a work in progress but I want to
>>> use it to fix a broken protocol. The protocol in question is EAP-pwd
>>> defined in RFC 5931. It does a "hunting and pecking loop" method
>>> of hashing to a curve that is similar, but worse, than the technique
>>> described in RFC 7664. (The method of obtaining a secret element in
>>> a MODP group is similarly broken). It is susceptible to side channel
>>> attack and I want to use the hash-to-curve draft to fix it.
>> Why not use a PAKE that comes out of the competition? And are you sure
>> the result of your chosen modification is actually secure?
>>
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> https://www.irtf.org/mailman/listinfo/cfrg