Re: [kitten] SPAKE preauth: generation of SPAKE2 secret input

[Nico Williams <[e-mail]>]

On Thu, May 14, 2015 at 08:54:39AM -0700, Watson Ladd wrote:
> Yes, which implies that it is not uniformly distributed over the whole
> domain of strings of the length of w. Uniform distribution means
> uniform: if it only ever takes on values in some subset, it isn't
> uniform. The fact that guessing attacks are possible demonstrates,
> that after conditioning on public values, it isn't uniform over the
> entire range.

OK, fair enough, but what about x.  How critical is it that it be
uniformly distributed?  You answered "The question of how far
from uniform x may be distributed is a subtle one, but my guess is
that even gross deviations from uniformity are fine, so taking a bunch
of bytes mod the curve order is ok."  Can you refine this answer?

My guess is that indeed, x's uniformity is not that important, because
if it were a well-known constant then this protocol devolves into one
where the attacker still has to mount an off-line dictionary attack in
order to recover w and session keys, so as the range of x choices
improves, the attacker's position worsens.  But if we add in timing side
channels then x's "gross deviation" from unifomity might yield more
information, no?

Nico
--