Re: [http-auth] I-D Action: draft-ietf-httpauth-mutual-algo-00.txt

[Yutaka OIWA <[e-mail]>]

Dear Ilari,

Thank you very much for valuable comments.
We'd asked our cryptographer colleagues' assistance
for answering, and please forgive us that we needed
some time to prepare these answers.

BTW,

2014-07-05 21:44 GMT+09:00 Ilari Liusvaara <[e-mail]>:
> On Fri, Jul 04, 2014 at 03:02:17PM -0700, [e-mail] wrote:
>>
>>       Filename        : draft-ietf-httpauth-mutual-algo-00.txt
>
> Section 2.3:
>
>>   where S_c1 is a random number within range [1, r-1].  The value of
>>   K_c1 MUST represent a valid curve point, and K_c1' SHALL NOT be 0_E.
>>   The server MUST check this condition upon reception.
>
> How this generalizes to non-cofactor-1 curves (those can be quite a bit
> faster than cofactor-1 ones)?
>
> Looking at the discrete-group algorithm, it generalizes as "valid point
> with large prime dividing order".
>
> So would:
>
> The value of K_c1 MUST represent a valid curve point, and [h]*K_c1'
> SHALL NOT be 0_E. The server MUST check this condition upon reception.
>
> Work?
> (0_E is the identity point, h is the curve cofactor.)
>
>>   where S_s1 is a random number within range [1, r-1].  The value of

It seems to work.  We need to modify some other parts of
documents (e.g. introducing the parameter h).
Original ISO specification also has a consideration for
non-cofactor-1 curves in the exactly same way.
I'd like to incorporate it in the next revision.

>>   K_s1 MUST represent a valid curve point and satisfy [4] * P'(K_s1) <>
>>   0_E. If this condition is not satisfied, the server MUST retry using
>>   another value for S_s1.  The client MUST check this condition upon
>>   reception.
>
> Same here.
>
> Also where does that multiplier 4 in check come from? Attempt at
> supporing h>1 curves (except that some stuff in use has h=8)?
>
> Should it be [h]*P'(K_s1) <> 0_E?

It is copied from the original ISO specification, and
it seems to be corresponding to the DL-case checking
"[t]he value of K_s1 MUST satisfy 1 < K_s1 < q-1",
that is to check K_s1 is not equivalent to either 1 or -1.
For this purpose, it should at least be [2] * P'(K_s1) <> 0_E.
I don't have a strict idea on why this is 4 instead of 2, though.
Does anyone have idea on this?
(Our colleague currently considers this 4 as not related to
 the cofactor setting).

> Section 2.2&2.3:
>
> 2.2 has:
>> The value of K_s1 MUST satisfy 1 < K_s1 < q-1.  If this condition
>> is not held, the server MUST retry using another value for S_s1.
>
> And 2.3:
>> The value of K_s1 MUST represent a valid curve point and satisfy
>> [4] * P'(K_s1) <> 0_E. If this condition is not satisfied, the
>> server MUST retry using another value for S_s1.
>
> If K_c1 has certain relationship (extremely unlikely) with
> J(pi), that will fail over and over again (no S_s1 works).
>
> Values of S_s1 that don't work are AFAICT very rare anyway (making
> failures be dominated by all sorts of calculation errors in K_s1).

I'd like to answer this in a separate mail.

-- 
Yutaka OIWA, Ph.D.                 Leader, System Life-cycle Research Group
                               Research Institute for Secure Systems (RISEC)
     National Institute of Advanced Industrial Science and Technology (AIST)
                       Mail addresses: <[e-mail]>, <[e-mail]>
OpenPGP: id[440546B5] fp[7C9F 723A 7559 3246 229D  3139 8677 9BD2 4405 46B5]