Subject: [Cfrg] using hash2curve in a protocol

From: Dan Harkins <[email-masked]>
Date: Wed, 24 Jul 2019 11:05:12 -0700

Hello,

   The hash-to-curve draft is still a work in progress but I want to
use it to fix a broken protocol. The protocol in question is EAP-pwd
defined in RFC 5931. It does a "hunting and pecking loop" method
of hashing to a curve that is similar, but worse, than the technique
described in RFC 7664. (The method of obtaining a secret element in
a MODP group is similarly broken). It is susceptible to side channel
attack and I want to use the hash-to-curve draft to fix it.

   To that end I have a new draft out that uses the Simplified SWU
method from -04 of the hash-to-curve draft:

   https://tools.ietf.org/html/draft-harkins-eap-pwd-prime-00

I would greatly appreciate any review of this draft and solicit
comments. This is definitely a work in progress too but I hope that
as hash-to-curve congeals this draft can follow hot on its heels.

   regards,

   Dan.

---

From: Björn Haase <[email-masked]>
Date: Wed, 24 Jul 2019 23:16:45 +0200

Hello Dan,

> I want to fix a broken protocol. The protocol in question is EAP-pwd
I fully agree that preparing a constant-time path is the right thing to do.

I have had a short look at RFC 5931 and it looks to me as if this is a
construction explicitly designed for circumventing the EKE and SPEKE
patents. My first impression is that it is way more complex and less
efficient
than actually necessary. I think that one should be able to achieve the
same
objectives with less computations and and less flows?

Are there real-world applications around which are constrained to
use the algorithms of RFC 5931 or are you considering applications
that are newly to be developped?

For new algorithms I'd rather suggest to spend the effort and time for
writing a new RFC, e.g. based on a SPEKE- derivative with subsequent
explicit
key confirmation. This way one does not need the inversions and just two
scalar
multiplications per peer.

If this approach might be an option for you, I'd be willing to join
forces with writing.

Yours,

Björn.

---

From: Watson Ladd <[email-masked]>
Date: Thu, 25 Jul 2019 15:19:40 -0700

> attack and I want to use the hash-to-curve draft to fix it.

Why not use a PAKE that comes out of the competition? And are you sure
the result of your chosen modification is actually secure?