Re: [Cfrg] I-D Action: draft-irtf-cfrg-spake2-08.txt

I'm one of the authors of [TDH] and I'm happy to see that our ideas
are considered for inclusion into the PAKE standard.

If I understand correctly, then the group proposes to use "scaled
coefficients" x and y in the SPAKE2 protocol to
avoid subgroup attacks. That is, replace any appearance of x and y in
the protocol with x*h and y*h, respectively.
This way the "algebraic key" K is forced to be in the prime-order sub-group.

My understanding is that the same argument can be applied to the
SPAKE2+ protocol by using scaled coefficients
x, y, and w1. (w0 does not have to be scaled.)

I will have a closer look.

 -Eike

On Wed, Mar 13, 2019 at 6:42 PM Greg Hudson <ghudson@mit.edu> wrote:
>
> On 3/13/19 12:50 PM, Chris Wood wrote:
> > Indeed, I forgot to consider these other subgroups when preparing the
> > PR. While the new cofactor check ensure that the small subgroups are
> > avoided, it does not help against those groups that are multiples of p
> > and (small) divisors of h. So perhaps in addition to the small subgroup
> > check, could we also use the result of the cofactor multiplication in
> > each computation? That is, for SPAKE, use S*h and T*h instead of S and H
> > when computing the shared secret? Currently, -08 says this is not done:
>
> That would work, but using scaled x and y coefficients solves the same
> problem, and is more consistent with X25519.  So I don't really know
> problem what the coefficient change in -08 was trying to solve.
>
> (I now agree with Kenny that there was a problem specifically with
> SPAKE2+.  But no changes to the SPAKE2 writeup should be required to
> solve that.)
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg