Re: [TLS] Remarks on draft-shin-tls-augpake-01

[Watson Ladd <[e-mail]>]

On Tue, Jan 7, 2014 at 12:55 PM, Ilari Liusvaara
<[e-mail]> wrote:
> On Tue, Jan 07, 2014 at 10:11:36AM -0800, Watson Ladd wrote:
>>
>> The only issue I see is the draft needs to be made group agnostic and
>> work on some sufficiently big ECC group. That's a straightforward, if
>> tedious, change of notation.
>
> Also, there are interesting elliptic groups it would need to work over
> that don't have h=1, but still have small h (e.g. M-series groups have
> h=8, E-series has IIRC h=4).
>
> Would checking for elements with small orders be enough (I think no
> seriously considered group would have more than 8 of those)?

Checking membership in [l]E(F_p) is expensive (1 exponentiation), but
would definitely do the job.

>
> The check in current spec that certain values are not -1, 0 or 1 can be
> seen as that sort of check, since those are the only values of small
> order (and 0 is just plain invalid)...
These are contributory tests.
>
> Oh, and don't forget checks that point decompression succeeds[1] or that
> claimed point is on the curve (for uncompressed representation).

Isn't this part of implementing any cryptography?

I can't speak for the authors, not being one of them, but I doubt this
sort of statement
would meet with strong opposition.

>
>
> [1] Certain square-root/curve implementations lead to twist attacks by
> sending invalid compressed points. Some others lead into a mess I don't
> know how what to make of[2]).
>
> [2] But probably it isn't good.
>
>
> -Ilari



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin