Re: [CFRG] Small subgroup question for draft-irtf-cfrg-hash-to-curve

["Hao, Feng" <[e-mail]>]

Hi Mike,

Thanks for your comment. I think we can have a more meaningful discussion on this if CPace and OPAQUE were concretely defined in the DSA/Schnorr or other MODP groups. Both protocols assume a special hash function of hashing a password to an non-identity element (base generator) in a designated prime-order group in constant time. So far, they depend on the hash-to-curve draft to realize that function, which leaves it undefined for DSA/Schorr or other MODP groups. As we can see from the example of SPEKE and Dragonfly, doing that in an MODP group is also a non-trivial task. I think this is certainly possible to avoid or minimize the effect of small subgroups in MODP, e.g., SPEKE, which does this mapping but at the cost of very expensive exponentiations because of the use of a safe prime and very long exponents. However, I don’t want to speculate how CPace/OPAQUE will want to do this until they are actually defined in an MODP setting.

Cheers,
Feng

From: Mike Hamburg <[e-mail]>
Date: Sunday, 11 April 2021 at 15:59
To: Hao, Feng <[e-mail]>
Cc: CFRG <[e-mail]>, Hugo Krawczyk <[e-mail]>
Subject: Re: [CFRG] Small subgroup question for draft-irtf-cfrg-hash-to-curve


> On Apr 11, 2021, at 11:19 AM, Mike Hamburg <[e-mail]> wrote:
> Or, to pull the analysis back to the full group G: the probability of landing in the small subgroup doesn’t depend on its absolute size q.  It depends on its size relative to G, which is q/(pq) = 1/p, i.e. it depends only on the size of the large group.

Sorry for the spam: “large group” should read “large prime-order subgroup”. — Mike