Re: [Cfrg] Some questions on draft-irtf-cfrg-spake2

[Richard Barnes <[e-mail]>]

Thanks, Greg, I had missed that point.

It might be worth noting that in the text somewhere, perhaps in the
Security Considerations.


On Mon, Apr 16, 2018 at 11:31 AM, Greg Hudson <[e-mail]> wrote:

> On 04/16/2018 10:45 AM, Richard Barnes wrote:
> > 1. The secrets w, w0, w1 aren't really specified, except "typically w
> > will be the hash of a user-supplied password, truncated and taken mod
> > p."  However, in the security considerations, you say "the
> > multiplication by cofactors eliminates the potential for mebership in a
> > small-order subgroup".
> >
> > Don't you need to specify that the integer w / w0 / w1 is divisible by
> > h, or equivalently, multiply it by h before use in the protocol?  It
> > seems like if not, then you end up leaking w mod h.
>
> w is multiplied by M or N, not by a point chosen by the peer.  Since M
> and N are members of the prime-order subgroup, wM and wN will also be.
>
> If a rogue peer sends a T or S value which is not in the prime-order
> subgroup, S-wN or T-wM will also not be in the prime-order subgroup,
> whether or not w is divisible by h.  But multiplication by x or y to
> produce x(S-wN) or y(T-wM) will yield a point in the prime-order
> subgroup, because x and y are divisible by h.  This step is what the
> security consideration refers to by "multiplication by cofactors".
>
> [I do not have a response to point 2, as SPAKE2+ isn't in my area of
> interest for this draft.]
>