Re: [Cfrg] Adoption of draft-ladd-spake2 as a RG document

["Dan Harkins" <[e-mail]>]

  Hello,

On Sun, December 14, 2014 8:41 am, Alexey Melnikov wrote:
> Hi,
> This message starts 3 weeks adoption call for draft-ladd-spake2. Please
> reply to this message or directly to CFRG chairs, stating one of the
> following
>
> 1) that you are happy to adopt the draft as a starting point
> 2) that you are not happy to adopt this draft
> or
> 3) that you think the document needs more work before the RG should
> consider adopting it

  I'm in favor of another PAKE being documented but I'm not sure
why SPAKE2 is the one.

> While detailed document reviews are generally welcome, this not a call to
> provide detailed comments on the document.

  SPAKE2 seems to be the Dual_EC_DRBG of PAKEs (and I'm very surprised
the author isn't being accused by a bunch of people on twitter, and some
hack tech blogger, of being an NSA plant out to subvert the Internet). There
are 2 constant elements used in the calculation and knowledge of the scalar
used to generate either of them would allow an attacker to break the
exchange. This draft will need to go through a rigorous NUMS procedure in
order to populate (the currently empty) section 3, a contentious step that
other PAKEs would not need to go through.

  There are other PAKEs out there so it would be nice to know why SPAKE2
is the one that should be pursued.

  regards,

  Dan.