Subject: [Cfrg] Some questions on draft-irtf-cfrg-spake2

From: Richard Barnes <[email-masked]>
Date: Mon, 16 Apr 2018 10:45:48 -0400

Hey Ben, Watson,

(CC'ing CFRG in case other folks are interested / because document updates
might be needed.)

1. The secrets w, w0, w1 aren't really specified, except "typically w will
be the hash of a user-supplied password, truncated and taken mod p."
However, in the security considerations, you say "the multiplication by
cofactors eliminates the potential for mebership in a small-order
subgroup".

Don't you need to specify that the integer w / w0 / w1 is divisible by h,
or equivalently, multiply it by h before use in the protocol?  It seems
like if not, then you end up leaking w mod h.

2. In SPAKE2+, [TDH] specifies that w0 and w1 are derived from the password
by hashing it together with the identities of the two sides.  Is there a
reason you don't make a similar requirement here?  When I read the SPAKE2+
section, the current wording led me to wonder whether w0 could be set to 0
or another static value, which seems not to be safe according to [TDH].

Thanks,
--Richard

P.S., a convenient PDF of the full version of [TDH] can be found at
http://www.shoup.net/papers/twindh.pdf

---

From: Greg Hudson <[email-masked]>
Date: Mon, 16 Apr 2018 11:31:50 -0400

On 04/16/2018 10:45 AM, Richard Barnes wrote:
> 1. The secrets w, w0, w1 aren't really specified, except "typically w
> will be the hash of a user-supplied password, truncated and taken mod
> p."  However, in the security considerations, you say "the
> multiplication by cofactors eliminates the potential for mebership in a
> small-order subgroup". 
> 
> Don't you need to specify that the integer w / w0 / w1 is divisible by
> h, or equivalently, multiply it by h before use in the protocol?  It
> seems like if not, then you end up leaking w mod h.

w is multiplied by M or N, not by a point chosen by the peer.  Since M
and N are members of the prime-order subgroup, wM and wN will also be.

If a rogue peer sends a T or S value which is not in the prime-order
subgroup, S-wN or T-wM will also not be in the prime-order subgroup,
whether or not w is divisible by h.  But multiplication by x or y to
produce x(S-wN) or y(T-wM) will yield a point in the prime-order
subgroup, because x and y are divisible by h.  This step is what the
security consideration refers to by "multiplication by cofactors".

[I do not have a response to point 2, as SPAKE2+ isn't in my area of
interest for this draft.]

---

From: Richard Barnes <[email-masked]>
Date: Mon, 16 Apr 2018 15:03:28 -0400

Thanks, Greg, I had missed that point.

It might be worth noting that in the text somewhere, perhaps in the
Security Considerations.