Re: [TLS] Remarks on draft-shin-tls-augpake-01

[Ilari Liusvaara <[e-mail]>]

On Tue, Feb 04, 2014 at 06:23:16PM +0900, SeongHan Shin wrote:
> Hi Watson,
> 
> Thank you for your comments!
> A simple way to make AugPAKE to be group agnostic is to convert AugPAKE to
> balanced one.
> Of course, I need to think about other ways.

I think Watson meant generalizing AugPAKE over arbitrary group with
appropriate hardness properties. Especially elliptic-curve ones.


I see nothing that wouldn't map in straightforward manner into elliptic
curves and only bn2bin(X) that wouldn't map in straightforward manner
to completely arbitrary group.


As for the -1, 0, 1 check, that can be replaced with check that:
a) The element is valid (e.g. nonzero or satisfies curve equation) AND
b) The order of element has prime factor of at least q

Those checks are quite cheap with most actually used elliptic curves.


Also, some misc feedback:
- What's the endian of bn2bin(X)? Big endian?
- How are X and Y encoded on the wire? bn2bin?
- Maybe expand on consequences of terminating on invalid username
  (allowing probing of valid usernames)?



-Ilari