Re: [Cfrg] Fwd: New Version Notification for draft-harkins-pkex-03.txt

[Greg Hudson <[e-mail]>]

On 11/01/2017 01:45 AM, Stanislav V. Smyshlyaev wrote:
> 4. The PKEX protocol translates code into an elliptic curve point in the
> following way. The code is hashed within other parameters and the hash
> value is used as a scalar which an elliptic curve point is multiplied
> by. There exists small but still non-null probability that this hash
> value turns to zero modulo q, where q is the order of the used elliptic
> curve point group. If that happens, an ephemeral key is not masked and
> the overall security of the PKEX protocol is violated. It seems useful
> to add checks here and introduce some algorithm that changes zero hash
> value to a nonzero value in a deterministic way.

An active attack against this case (attempting to subvert the DH
exchange as if there is no mask) succeeds with probability 1/q, which is
no more likely than attempting to subvert the DH exchange using any
other specific mask value as an offset.  Is that a sufficient reason to
add an impossible-to-test special case?

> 2. It seems useful to add checks of X' and Y' for not being equal to the
> point at infinity.

Similarly, what's the justification for adding this special case?