Subject: Re: [Cfrg] One question about MODP: the structure of DLP prime in a finite field

From: "Hao, Feng" <[email-masked]>
Date: Tue, 19 Nov 2019 14:07:20 +0000

Dear Guilin,
 
 > About security, I also feel it looks secure if we only select short exponents, say 256 bit strings for x and y in SPEKE, even though q is 2047 bits. However, to my best knowledge, it seems that this has not been confirmed by any academic research [I may be wrong on this]. Security is subtle and tricky...
    
The use of a short exponent for a safe-prime modulus was first suggested in Jablon's original SPEKE paper [1], but later in a follow-up paper [2] he gave a more cautionary note that this might not be safe. Indeed, the use of a short exponent in this manner implies that given a full-length secret key in Z_q on the exponent, nearly 90% secret bits are exposed by definition (and fixed at 0), and the security relies on the rest small percentage of bits being incomputable. The security of this practice hasn't been confirmed by any other study as far I am aware. So it remains a heuristic suggestion. Quit likely, the CDH and DDH assumptions will not hold if that matters.

[1] D. Jablon, “Strong password-only authenticated key exchange,” ACM Computer Communications Review, Vol. 26, No. 5, pp. 5–26, October 1996.
[2] D. Jablon, “Password authentication using multiple servers,” Topics in Cryptology – CT-RSA, pp. 344–360, LNCS 2020, April 2001.

---

From: Rene Struik <[email-masked]>
Date: Tue, 19 Nov 2019 10:36:57 -0500

Dear colleagues:

The paper [a] may be of interest.

[a] Short Exponents Diffie-Hellman Problems (Kaoru Kurosawa, Takeshi 
Koshiba, PKC 2004)

Best regards, Rene

On 11/19/2019 9:07 AM, Hao, Feng wrote:
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

-- 
email: [email-masked] | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363

---

From: "Hao, Feng" <[email-masked]>
Date: Tue, 19 Nov 2019 15:58:59 +0000

Dear Rene,

Thanks for the link. I'm not sure if the proofs are complete though as they are deferred to a full paper. But I couldn't find the full paper .... Maybe someone knows?

The following paper may also be interest (Oorschot, Wiener, Encrypt'96)

https://people.scs.carleton.ca/~paulv/papers/Euro96-DH.pdf

The general recommendation tends to be a line with using short exponents for a subgroup of prime order. That is more an established practice.

Cheers,
Feng

On 19/11/2019, 15:37, "Rene Struik" <[email-masked]> wrote:

    Dear colleagues:

    
    Best regards, Rene