Subject: [Cfrg] PAKE

From: "Igoe, Kevin M." <[email-masked]>
Date: Wed, 2 May 2012 16:07:51 -0400

One quick piece of feedback.  In the EC case, the construction

of the PassWrod Element (PWE) on the curve involves

trying to take the square root of f = x^3 + ax + b.  This

is MUCH easier to do in p = 3 mod 4 (in this case compute

y = f^( (p+1)/4).  If y^2 = f, your done, otherwise y^2 = -f

and f doesn't have a square root mod p.

The p = 1 mod 4 case gets ugly, especially if p-1 is divisible

by a high power of 2.   Luckily most EC groups use p=3 mod 4.

I'd advise adding the constraint that for eliiptic cureves pmust

be 3 mod 4. 

P.S.  The fact that f has a preferred square root mod p might

eliminate the code that decides whether to use (x,y) or

(x,-y) as the PWE.

Kevin M. Igoe       |   "Everyone is entitled to their own
[email-masked] <mailto:[email-masked]>   |    opinions, but not to their
own facts."
                           |       - Daniel Patrick Moynihan -