Re: [TLS] Remarks on draft-shin-tls-augpake-01

[Ilari Liusvaara <[e-mail]>]

On Tue, Jan 07, 2014 at 10:11:36AM -0800, Watson Ladd wrote:
> 
> The only issue I see is the draft needs to be made group agnostic and
> work on some sufficiently big ECC group. That's a straightforward, if
> tedious, change of notation.

Also, there are interesting elliptic groups it would need to work over
that don't have h=1, but still have small h (e.g. M-series groups have
h=8, E-series has IIRC h=4).

Would checking for elements with small orders be enough (I think no
seriously considered group would have more than 8 of those)?

The check in current spec that certain values are not -1, 0 or 1 can be
seen as that sort of check, since those are the only values of small
order (and 0 is just plain invalid)...

Oh, and don't forget checks that point decompression succeeds[1] or that
claimed point is on the curve (for uncompressed representation).


[1] Certain square-root/curve implementations lead to twist attacks by
sending invalid compressed points. Some others lead into a mess I don't
know how what to make of[2]).

[2] But probably it isn't good.


-Ilari