Re: [Cfrg] Criteria for the selection of new ECC mechanisms

[Rene Struik <[e-mail]>]

Okay, with EKE indeed this would be the case.

Rene

On 4/29/2014 2:55 PM, Michael Hamburg wrote:
>
> On Apr 29, 2014, at 11:43 AM, Rene Struik <[e-mail] 
> <mailto:[e-mail]>> wrote:
>> RS>>
>> I think Michael Hamburg also concurred with my note. I fail to see 
>> why one cannot possibly get a good PAKE protocol that relies, e.g., 
>> on GLV/GLS-friendly curves. Can you give an example of a PAKE scheme 
>> that "requires" indistinguishability, so as to have a proof point?
>> <<RS
>
> EKE requires indistinguishability.  You do a DH key exchange, but 
> encrypt the ephemerals with the password.  This requires that the 
> ephemerals are encoded in a way that cannot be distinguished from 
> random.  If the adversary starts guessing passwords, then wrong 
> guesses will result in random-looking data (in the ideal cipher model 
> or under assumptions about the KDF).  If the adversary could 
> distinguish the real encoded point from these random points, it would 
> leak information about the password, and over many connections the 
> password would be revealed by a passive attack.
>
> But you can get indistinguishability for any elliptic curve using 
> Tibouchi/BCIMRT’s Elligator Squared.
>
> — Mike


-- 
email: [e-mail] | Skype: rstruik
cell: [phone] | US: [phone]