Re: [kitten] SPAKE preauth: generation of SPAKE2 secret input

[Nico Williams <[e-mail]>]

On Wed, May 13, 2015 at 09:15:19PM -0700, Watson Ladd wrote:
> On May 13, 2015 9:05 AM, "Nico Williams" <[e-mail]> wrote:
> > It absolutely could be an implementation-only abstraction.  If it will
> > be useful for many implementations though, it'd be useful to write that
> > up.  In particular, adding curves to an implementation will be easy if
> > there is such an abstraction internally.
> 
> Many implementations already have such a layer. I don't see how it's
> useful to write up: it's obvious, and doesn't affect interop.

True.  (But we must have a point representation, which per-CFRG is now
part of each curve's specification.  We have a point representation for
Curve25519 for DH, but not yet for point addition.)

> > (This was in response to an off-list question by an implementor about
> > how to make it easy to add curves to their implementation given that
> > they are using OpenSSL, without first having to add them to OpenSSL.
> > Two simple answers are: don't, or add such an abstraction.)
> 
> I believe OpenSSL does permit specifying parameters of arbitrary
> Weierstrass curves. In practice I don't know how useful that is. Or am
> I misunderstanding the question?

The context is an implementation of Kerberos that would like such an
abstraction so it can use curves not yet supported by OpenSSL, in
particular Curve/Ed25519.

Nico
--