[Cfrg] Additional questions to consider for the PAKE Selection Process

["Hao, Feng" <[e-mail]>]

Dear CFRG,

I would like to suggest the following additional questions to consider for the PAKE selection process.


  *   A PAKE scheme should define how the explicit key confirmation is performed and clearly state whether this procedure is optional or mandatory.
  *   The authors should state if the two communicating parties can initiate the key exchange process at the same time, or it must always be the case that only one party can initiate the process.
  *   (Related to above) The authors should clearly state the “round efficiency” of the PAKE protocol. In a standard two/multi-party secure computation setting, the “round” is defined as a step in which all parties can complete operations at the same time without depending on each other. In practice, a 2-round protocol could be implemented as 2 flows or 3 flows depending on the application context, but that’s more the implementation detail.
  *   If a PAKE scheme relies on the assumption of a trusted setup--more specifically, the discrete logarithm relationship between the two group elements in the system setup MUST be unknown--in anticipation of the worst but not impossible scenario, the authors should clearly state the security implications when the discrete logarithm relationship becomes known, and the subsequent mitigation measures.

Any comments are most welcome.

Cheers,
Feng