[Cfrg] Some questions on draft-irtf-cfrg-spake2

[Richard Barnes <[e-mail]>]

Hey Ben, Watson,

(CC'ing CFRG in case other folks are interested / because document updates
might be needed.)

1. The secrets w, w0, w1 aren't really specified, except "typically w will
be the hash of a user-supplied password, truncated and taken mod p."
However, in the security considerations, you say "the multiplication by
cofactors eliminates the potential for mebership in a small-order
subgroup".

Don't you need to specify that the integer w / w0 / w1 is divisible by h,
or equivalently, multiply it by h before use in the protocol?  It seems
like if not, then you end up leaking w mod h.

2. In SPAKE2+, [TDH] specifies that w0 and w1 are derived from the password
by hashing it together with the identities of the two sides.  Is there a
reason you don't make a similar requirement here?  When I read the SPAKE2+
section, the current wording led me to wonder whether w0 could be set to 0
or another static value, which seems not to be safe according to [TDH].

Thanks,
--Richard

P.S., a convenient PDF of the full version of [TDH] can be found at
http://www.shoup.net/papers/twindh.pdf