Subject: Re: [Cfrg] using hash2curve in a protocol

From: Armando Faz <[email-masked]>
Date: Wed, 24 Jul 2019 13:10:51 -0700

Hello Dan,

It's great to hear that protocols are moving from using general groups to
use elliptic curve groups. Hashing to curve is an important piece to make
this transition.

One feature intended by the hash-to-curve draft is the ability to
instantiate a named hash to curve suite for a particular elliptic curve
group. Thus, in the eap-pwd-prime draft, it might be better to refer to the
suite used by the protocol, instead of duplicating the description of SSWU
method, since the hash to curve draft will carry with all details for
easier usage.

Happy to assist you on the details regarding hash to curve suites.

-- 
Armando Faz
Cloudflare Inc.

---

From: Björn Haase <[email-masked]>
Date: Fri, 26 Jul 2019 08:07:06 +0000

>Why not use a PAKE that comes out of the competition?
Yes. Note that in my earlier post I did not refer to my own CPace suggestion but to a "SPEKE-based construction". This was not a typing mistake but intention.

My point was rather: If we spend efforts on writing a RFC, we might be better off using a new efficient construction rather than using an approach which is more complex because of patent circumventions for patents that already have expired.

Apart of that: Yes, I believe that CPace would be a secure candidate protocol, just as TBPEKE. With TBPEKE, we don't have the session ID complexity and don't need to bother with the mappings but it needs some form of trusted setup and is a bit less efficient. Since the paper of Jose Becarra, Dimiter Ostrev and Marjan Skrobot https://eprint.iacr.org/2019/351 also SPAKE2 might do IMO. This one however would be somewhat more complex. The only advantage of SPAKE2 in comparison with SPEKE-based constructions might have been in the past that it was not covered by the SPEKE patents.

Mit freundlichen Grüßen I Best Regards 

Dr. Björn Haase 

Senior Expert Electronics | TGREH Electronics Hardware
Endress+Hauser Conducta GmbH+Co.KG | Dieselstrasse 24 | 70839 Gerlingen | Germany
Phone: +49 7156 209 377 | Fax: +49 7156 209 221
[email-masked] |  www.conducta.endress.com 

Endress+Hauser Conducta GmbH+Co.KG
Amtsgericht Stuttgart HRA 201908
Sitz der Gesellschaft: Gerlingen
Persönlich haftende Gesellschafterin:
Endress+Hauser Conducta Verwaltungsgesellschaft mbH
Sitz der Gesellschaft: Gerlingen
Amtsgericht Stuttgart HRA 201929
Geschäftsführer: Dr. Manfred Jagiella

Gemäss Datenschutzgrundverordnung sind wir verpflichtet, Sie zu informieren, wenn wir personenbezogene Daten von Ihnen erheben.
Dieser Informationspflicht kommen wir mit folgendem Datenschutzhinweis (https://www.endress.com/de/cookies-endress+hauser-website) nach.

Disclaimer: 

The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you receive this in error, please contact the sender and delete the material from any computer. This e-mail does not constitute a contract offer, a contract amendment, or an acceptance of a contract offer unless explicitly and conspicuously designated or stated as such.