Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd

Robert Ransom <rransom.8774@gmail.com> Thu, 05 December 2013 21:10 UTC

Return-Path: <rransom.8774@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C310D1AE110 for <tls@ietfa.amsl.com>; Thu, 5 Dec 2013 13:10:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.75
X-Spam-Level:
X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0-pvkgr0rgqv for <tls@ietfa.amsl.com>; Thu, 5 Dec 2013 13:10:30 -0800 (PST)
Received: from mail-qc0-x232.google.com (mail-qc0-x232.google.com [IPv6:2607:f8b0:400d:c01::232]) by ietfa.amsl.com (Postfix) with ESMTP id 6078D1AE106 for <tls@ietf.org>; Thu, 5 Dec 2013 13:10:30 -0800 (PST)
Received: by mail-qc0-f178.google.com with SMTP id i17so5363843qcy.37 for <tls@ietf.org>; Thu, 05 Dec 2013 13:10:26 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=hLO79s3k/4/Jm9LpJxEJNGw/n1DOLSKmB/RlS/I/9/0=; b=doeXWzDdI7iEKVFvIpGdi8MX6WR7llHEqWyjT385jOiwCYCBryFF6/2Nhac1Ul6+5t 7X1ivKnziFi5UxoXWgcfc01S6jMnUSY0Kj4/gZ1PG63lUQSCOBh7CwALLHGVs9Jqr0YS 00TQkdrdUoOiqZ6qYh6d0xvsnwvct0msAsYaNV6buNVDOBvC46pwOMCuzmVGXObFbXEX pAOWfW21v0KgpDPhB9op6gBwHsoO7YgX/xBoN+60kcls2eCWn3rq7DAUJVrh8UlBzwkO xjwmV4xl1DzTmNTUL0D/EN2jBIq4ip33ncaqPQ3t4ByO+6WmB7Gl700FhwSpPv6GHcMK fA/A==
MIME-Version: 1.0
X-Received: by 10.224.80.195 with SMTP id u3mr44005qak.94.1386277826508; Thu, 05 Dec 2013 13:10:26 -0800 (PST)
Received: by 10.229.8.3 with HTTP; Thu, 5 Dec 2013 13:10:26 -0800 (PST)
In-Reply-To: <CAGZ8ZG3HwTe0gvrrieYAVZZSd=xfU9GWYo1YHMHWmD9c+EsxbQ@mail.gmail.com>
References: <3065D910-832C-47B6-9E0B-2F8DCD2657D2@cisco.com> <529C990D.3020608@gmail.com> <CACsn0cmtP_dF7N2op4DZUwR8t-fW30GmtdqQoteZ+9Y0oH3dUg@mail.gmail.com> <a4b1729af4966e99df1582943f02a0a8.squirrel@www.trepanning.net> <CACsn0cksrU2GErd6FkZPkXKXK4pSJhTbBoJ-0C-14jsM=UY2iQ@mail.gmail.com> <14e67efee74d2ec6d535f6750ed829db.squirrel@www.trepanning.net> <CACsn0c=PnB2CA8rpNtcOp6RRLNWHEPN-aN+AdWSF7FJM2wZOog@mail.gmail.com> <6d86c3be1741ed14992ec8662e0d32c7.squirrel@www.trepanning.net> <CADMpkcKTAARYK2id27T44eVyx6gF24mkt9nAkUZbSmwtEtd2gg@mail.gmail.com> <6c129fd89a9e5953ba844e4e1d1e6e98.squirrel@www.trepanning.net> <CAGZ8ZG0n7AFWc_WpxLzKbhnRxz8hkQAD-j8VDtX_GOHD5Nc6nw@mail.gmail.com> <7c8448fa356f5d764186ca62552efb1d.squirrel@www.trepanning.net> <CAGZ8ZG3HwTe0gvrrieYAVZZSd=xfU9GWYo1YHMHWmD9c+EsxbQ@mail.gmail.com>
Date: Thu, 5 Dec 2013 13:10:26 -0800
Message-ID: <CABqy+spKVi3XbU8-T40O=+zTeheey3dvbZ-uahjvNaDpGHA_HA@mail.gmail.com>
From: Robert Ransom <rransom.8774@gmail.com>
To: Trevor Perrin <trevp@trevp.net>
Content-Type: text/plain; charset=UTF-8
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Dec 2013 21:10:32 -0000

On 12/5/13, Trevor Perrin <trevp@trevp.net> wrote:

> Not true, for example see Hamburg and Bernstein's Elligator 2 [1],
> which could be used as the basis for a DH-EKE style PAKE.

In particular, 2^255-21 factors as a product of two 128-bit numbers
(12405336376215349613*16478153705137396313 and
96110449917563*20607492579733193238707*11*13); it would be fairly easy
to build a Feistel-type block cipher operating between those two
subrings.  (There must be (at least) two natural points in the image
of the Elligator 2 map that could be excised from the set of permitted
public keys; I know there are for Elligator 1.)

(I'm not going to look for ways to split a large subset of 2^414 - 17 now.)


Robert Ransom