Re: [Cfrg] Criteria for the selection of new ECC mechanisms

[Michael Hamburg <[e-mail]>]

On Apr 29, 2014, at 11:43 AM, Rene Struik <[e-mail]> wrote:
> RS>>
> I think Michael Hamburg also concurred with my note. I fail to see why one cannot possibly get a good PAKE protocol that relies, e.g., on GLV/GLS-friendly curves. Can you give an example of a PAKE scheme that "requires" indistinguishability, so as to have a proof point?
> <<RS

EKE requires indistinguishability.  You do a DH key exchange, but encrypt the ephemerals with the password.  This requires that the ephemerals are encoded in a way that cannot be distinguished from random.  If the adversary starts guessing passwords, then wrong guesses will result in random-looking data (in the ideal cipher model or under assumptions about the KDF).  If the adversary could distinguish the real encoded point from these random points, it would leak information about the password, and over many connections the password would be revealed by a passive attack.

But you can get indistinguishability for any elliptic curve using Tibouchi/BCIMRT’s Elligator Squared.

— Mike