Re: [kitten] SPAKE preauth: generation of SPAKE2 secret input

[Nico Williams <[e-mail]>]

On Wed, May 13, 2015 at 07:17:59AM -0700, Watson Ladd wrote:
> >> My take is that the public values being of the for xG + wM, where x
> >> should be a randomly and uniformly chosen scalar, the xG term will
> >> cause
> >> the public value to be as uniformly distributed as x regardless of
> >> how
> >> non-uniform w might be.  So I think there's no harm in picking a
> >> simple
> >> mapping from the long-term key to w, provided there's a way to
> >> abstract
> >> this (see below).
> 
> w is not distributed uniformly: far from it. The question of how far

That depends on how its salted.  For our purposes, in practice it's not.

> from uniform x may be distributed is a subtle one, but my guess is
> that even gross deviations from uniformity are fine, so taking a bunch
> of bytes mod the curve order is ok. But rejection sampling or modular
> reduction of longer strings are both easy to implement to sidestep
> this issue.

That's what I thought.

> SPAKE2 requires addition be supported. That rules out Kummer lines.
> The CFRG has not specified a model and how to encode points on that
> for addition to work. When they do I will modify the draft
> accordingly.
> 
> However, I don't understand why the above abstraction isn't an
> implementation detail only. All one has to provide to use this draft
> are two generators and how to encode group elements. The algorithms
> for addition, multiplication etc. will be documented in the CFRG
> eventually. It's true that many groups only come with one canonical
> generator, but any sort of hashing method will give you two
> generators.

It absolutely could be an implementation-only abstraction.  If it will
be useful for many implementations though, it'd be useful to write that
up.  In particular, adding curves to an implementation will be easy if
there is such an abstraction internally.

(This was in response to an off-list question by an implementor about
how to make it easy to add curves to their implementation given that
they are using OpenSSL, without first having to add them to OpenSSL.
Two simple answers are: don't, or add such an abstraction.)

Nico
--