Subject: [Cfrg] ISE needs reviewers/reviews for draft-smyshlyaev-sespake-09

From: Nevil Brownlee <[email-masked]>
Date: Thu, 13 Oct 2016 14:43:10 +1300

Hi CFRG folk:

Stanislav Smyshlyaev has submitted this draft to the Independent Stream,
so now I'm looking for reviews of it.  Any comments on this draft,
especially in the form of brief reviewers - or offers to do a full
review - would be much appreciated.

Please send comments, reviews or offers to review to me, that's
ISE <[email-masked]>

Cheers, Nevil

-- 
Nevil Brownlee (ISE), [email-masked]

---

From: Mike Hamburg <[email-masked]>
Date: Thu, 13 Oct 2016 10:54:17 -0700

Hi Nevil,

I read over the document briefly, especially the diffs.

The protocol hasn’t changed much, and it’s still basically fine but I think it could be better.

I’m not sure what was gained by replacing INT with an abstract function phi.  Since phi = INT in the example, it seems to just give wiggle room that will not be used.

The new diagram is helpful.

The “Byte representation of a point X,Y” is a little unclear.  Perhaps the authors should declare a function intEncode_n :: [0,n) -> B_{ceil log_{256} n}, and say that (X,Y) encodes to intEncode_p(X) || intEncode_p(Y).  Also, the lower-case p there is correct, but it’s the characteristic and not the subgroup generator.  The subgroup generator is called capital P.  But you do want the lower-case p.

Also, the authors might want to consider point compression.  Or not.

I’m skeptical as to whether the innovative small subgroup handling gains anything.  Why does one need to test whether Q_B is in the small subgroup?  Does the protocol need to be contributory even if the adversary knows the password?  It looks to me like the small subgroup handling is a convoluted way to abort the protocol without aborting it.  Perhaps there is a reason involving the failure counters.

I’m still not a fan of the multiple Q points.  Either there is an attack on one Q or there is not.  If there is an attack, reducing its likelihood of success to 1/3 seems like a waste of time.  Just generating Q using a hash of P is enough to prevent a backdoor attack.

Cheers,
— Mike

> On Oct 12, 2016, at 6:43 PM, Nevil Brownlee <[email-masked]> wrote:
> 
> 
> Hi CFRG folk:
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg