Re: [Cfrg] I-D Action: draft-irtf-cfrg-spake2-08.txt

Eike Kiltz <> Thu, 14 March 2019 10:58 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 8FCF9128B36 for <>; Thu, 14 Mar 2019 03:58:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id G3a7kkIBIwdv for <>; Thu, 14 Mar 2019 03:58:45 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4864:20::135]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 976EB12788D for <>; Thu, 14 Mar 2019 03:58:45 -0700 (PDT)
Received: by with SMTP id o76so758214ita.3 for <>; Thu, 14 Mar 2019 03:58:45 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:reply-to:from:date:message-id :subject:to:cc; bh=rdQ0/89LadDoCaxWf+l7TUFd3qAmphzpY3Bjie/ru3U=; b=gLthdK9n8kYS9ww9mR3YWzrCL5K10LOGBjDsDH5UKFzmwPsl1hCJJQQHX/yvMSGYBp 6VJu0qpGPwx8jkcRPs5BWUTyYCXAe6uhkc/stmbhx7gQe/98rFf9D+2HW8h59sLphhFM JcB1LEhYn89Nw1WXQ5XH2hiCFEfjqFopguNhP7x8O1r32vhrjzdGfCmd7QYYc7TstSDi oODp+6Pdi5A6Uj3l6ssXtlFgmkxcVVjhv5itd9hPy5OwNzHMc0tztN1JInl+GEbI7Gqq 69GaHPOIfbMw2/5B4Nyk0HBI3Cs79Ti08hhgEHNSl/6Vuzgj7DoYhgXweCxm3x/kjRaM 2Pxg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:reply-to :from:date:message-id:subject:to:cc; bh=rdQ0/89LadDoCaxWf+l7TUFd3qAmphzpY3Bjie/ru3U=; b=Q8MvEZjh9QCIXfQAwDsaCu7GvVuNLT6A5M+rJqUCMM+dBcdFUl+V1e8EqtnSszXUoF p2s1h6yYaVEog+z57H1ldF4xaKrdwcZFr+FTf3K1qQdPvZ2Y6PIyMFLrwwQlV+aN3cRj qKR2XxPPRBN58KrvvaU9LCQlM51JTn8qvuk1I4xw/idtLTLPohVNpMgUG3JR4Gguifqg C7lHted8qxlAKRetRjmrK2cNvgn91j4ZNmXInjjwD8WxpFYwiS4bKQPG+PeSVN6EiPNR ciEV63x+lbdvfYVITMdk7c3I9nEDukzghR09PHx4ZgrkpopgrpQM60gLWjQI/7nAKCRD +VMQ==
X-Gm-Message-State: APjAAAWauConvsUKqcjA1O8t+J2+2d+P7z7mjDR+89KOy9RqUsuUVvzG MpEk4Ok5sPz2cHRzDv0kdWGZ1QrZ4snOGjmSMWg=
X-Google-Smtp-Source: APXvYqy8n/Aebfb1o7SBtZnqNlj2aAst+RuYvaI8YiYhzqHH+tZYklBN+O9b9jyMJu8/VIKFB+NQWxuCx67bJ+G+QF4=
X-Received: by 2002:a05:660c:1c8:: with SMTP id s8mr1707776itk.20.1552561124792; Thu, 14 Mar 2019 03:58:44 -0700 (PDT)
MIME-Version: 1.0
References: <> <> <> <> <> <>
In-Reply-To: <>
From: Eike Kiltz <>
Date: Thu, 14 Mar 2019 11:58:33 +0100
Message-ID: <>
To: Greg Hudson <>
Cc: Chris Wood <>,
Content-Type: text/plain; charset="UTF-8"
Archived-At: <>
Subject: Re: [Cfrg] I-D Action: draft-irtf-cfrg-spake2-08.txt
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 14 Mar 2019 10:58:48 -0000

I'm one of the authors of [TDH] and I'm happy to see that our ideas
are considered for inclusion into the PAKE standard.

If I understand correctly, then the group proposes to use "scaled
coefficients" x and y in the SPAKE2 protocol to
avoid subgroup attacks. That is, replace any appearance of x and y in
the protocol with x*h and y*h, respectively.
This way the "algebraic key" K is forced to be in the prime-order sub-group.

My understanding is that the same argument can be applied to the
SPAKE2+ protocol by using scaled coefficients
x, y, and w1. (w0 does not have to be scaled.)

I will have a closer look.


On Wed, Mar 13, 2019 at 6:42 PM Greg Hudson <> wrote:
> On 3/13/19 12:50 PM, Chris Wood wrote:
> > Indeed, I forgot to consider these other subgroups when preparing the
> > PR. While the new cofactor check ensure that the small subgroups are
> > avoided, it does not help against those groups that are multiples of p
> > and (small) divisors of h. So perhaps in addition to the small subgroup
> > check, could we also use the result of the cofactor multiplication in
> > each computation? That is, for SPAKE, use S*h and T*h instead of S and H
> > when computing the shared secret? Currently, -08 says this is not done:
> That would work, but using scaled x and y coefficients solves the same
> problem, and is more consistent with X25519.  So I don't really know
> problem what the coefficient change in -08 was trying to solve.
> (I now agree with Kenny that there was a problem specifically with
> SPAKE2+.  But no changes to the SPAKE2 writeup should be required to
> solve that.)
> _______________________________________________
> Cfrg mailing list