Re: [Cfrg] Question about Spake2

[Watson Ladd <[e-mail]>]

On Mon, Feb 17, 2020 at 6:51 AM Scott Fluhrer (sfluhrer)
<[e-mail]> wrote:
>
> In your answer to Question 1 of the Round 2 questions, you stated:
>
>
>
> The next version will include an option to have M and N based on party
>
> identities, ensuring that an attacker with the ability to solve a
>
> discrete logarithm problem can only compromise a single session per
>
> discrete logarithm computed.
>
>
>
> The current draft of Spake2 (draft-irtf-cfrg-spake2-09) does not include this option.  Will there be a version of the draft that would include this option that we could review?

I'm working on getting the text out and fixing some minor typos that
were detected in earlier revisions. The suggestion is made in
https://eprint.iacr.org/2019/1194.pdf and I'll be following that. It's
just M=H(A, B, 1), N=H(A, B, 2) with appropriate domain separation.

>
>
>
> BTW: my personal opinion is that this shouldn’t be an option, instead it should be mandatory.  An option means that it is selectable by the protocol, and I distrust forcing the protocol designers to make decisions with security implications that they might not fully understand.

Including M and N per identity forces a dependency on hash2curve,
which is a barrier to implementation. The difference in number of
discrete logs required is a few months of Moore's law and linear in
number of associations.

>
>



--
"Man is born free, but everywhere he is in chains".
--Rousseau.