[Cfrg] Answers to round 2 for SPAKE2

[Watson Ladd <[e-mail]>]

Dear all,
Apologies if you may receive this email multiple times: there have
been some technical difficulties.

Question 1: (to SPAKE2): Can you propose a modification of SPAKE2
(preserving all existing good properties of PAKE2) with a
correspondingly updated security
proof, addressing the issue of a single discrete log relationship necessary
for the security of all sessions (e.g., solution based on using
M=hash2curve(A|B), N=hash2curve(B|A))?


The next version will include an option to have M and N based on party
identities, ensuring that an attacker with the ability to solve a
discrete logarithm problem can only compromise a single session per
discrete logarithm computed. This form does introduce a dependency on
the hash2curve draft, and requires an invocation of hash2curve per
pair of participants. The proof of such a construction is in
https://eprint.iacr.org/2019/1194.


Question 2:Can the nominators/developers of the
protocols please re-evaluate possible IPR conflicts between their
candidates protocols and own and foreign patents? Specifically, can you
discuss the impact of U.S. Patent 7,047,408 (expected expiration 10th of
march 2023) on free use of SPAKE2 and the impact of EP1847062B1 (HMQV,
expected expiration October 2026) on the free use of the RFC-drafts for
OPAQUE?


I’m not a patent lawyer, and cannot speculate on any IPR conflicts
that may or may not exist.


Question 4:What can be said about the property of
"quantum annoyance" (an attacker with a quantum computer needs to solve
[one or more] DLP per password guess) of the PAKE?


An adversary needs to solve a single DLP and then carry out an online
attack to recover the password without further quantum work. It's
possible better attacks exist.


Question 5: What can be said about "post-quantum preparedness" of the PAKE?

SPAKE2 is unlikely to have a post-quantum alternative.

Sincerely,
Watson Ladd