Re: [Cfrg] password-based key exchange

["Dan Harkins" <[e-mail]>]

  Hi Kevin,

  Thank you very much for reviewing this draft.

On Wed, January 4, 2012 5:14 am, Igoe, Kevin M. wrote:
> I really like this idea & can find no problems.
>
> One nitpicking detail:  HashToElement should return an element of a
> cryptographic subgroup of (Z/pZ)*, i.e. an element of a cyclic subgroup
> of prime order q, q suitably large.  (Of course both sides should use
> the
> same subgroup, but in practice this isn't a problem since the standard
> mod p
> groups specify both q and an element g of order q which generates the
> cryptographic subgroup.)

  I believe the two techniques used in section 4.1-- one for FFC groups,
another for ECC groups-- return an element from a subgroup of prime
order q.

> I'm curious as to what size parameters are under consideration by IEEE.

  The specification of this key exchange in IEEE 802.11 uses the IANA
registry created by IKE for "diffie-hellman groups" so it can use the
NIST elliptic curves, and the safe prime FFC groups (from 1024 bits
up to 8192 bits). Implementations are required to support NIST's 256 bit
random ECP group (group 19 from IKE's IANA registry).

  regards,

  Dan.