Re: [Cfrg] I-D Action: draft-irtf-cfrg-spake2-08.txt

[Greg Hudson <[e-mail]>]

On 3/13/19 11:01 AM, Paterson  Kenneth wrote:
>     > 		page 3:  "B stores L=w1*g and w0." (In the context of SPAKE2+.)
>     > 	-- Assuming g is the generator of G of order p*h, notice that this element L is not necessarily in the order p subgroup of G, since w1 (and w0) are not necessarily multiples of h.
>     
>     Since L is a multiple of G, it will be of order p (since G is of order
>     p).  Unless I'm badly mistaken?
>    
> G is not of order p (at least that's how I read the spec.) - rather it has order hp.

If g is the generator, then in the new terminology L=w1*P.  P is a point
of order p, so L should have order p as well.

> See Section 3.1:
> 	Suppose G has order p*h where p is a large prime; h will be called the cofactor.

That refers to the group.  (Having G refer to both the group and the
generator is of course confusing, and was rightly rectified in -08.)

The new draft defines "a generator P of the (large) prime-order subgroup
of G".  In the old draft, it was not clear in the text that G (the
generator point) was a point of order p, but for edwards25519 and
edwards448 it used the standard generators for those groups, which are
of order p.