Subject: Re: [CFRG] Symmetric SPAKE2

From: "Filippo Valsorda" <[email-masked]>
Date: Mon, 21 Jun 2021 17:57:24 +0200

2021-04-27 06:04 GMT+02:00 Watson Ladd <[email-masked] <mailto:watsonbladd%40gmail.com>>:
> On Mon, Apr 26, 2021 at 6:20 PM Filippo Valsorda <[email-masked] <mailto:filippo%40ml.filippo.io>> wrote:
> >
> > Hi all,
> >
> > I am trying to figure out the properties of symmetric SPAKE2, where there is no
> > ordering and M = N.
> >
> > The only note I can find in draft-irtf-cfrg-spake2-18 is this in Section 5.
> >
> >    In addition M and N may be equal to have a symmetric variant.  The
> >    security of these variants is examined in [MNVAR].  This variant may
> >    not be suitable for protocols that require the messages to be
> >    exchanged symmetrically and do not know the exact identity of the
> >    parties before the flow begins.
> >
> > https://tools.ietf.org/html/draft-irtf-cfrg-spake2-18#section-5
> >
> > I interpret "these variants" as the ones with M = N, and "This variant" as the
> > "Per-User M and N" one, meaning this paragraph is saying that you can't do
> > per-user M and N if M = N, which tracks.
> >
> > However, the spec is hardcoding M and N to different values, so it doesn't
> > actually seem to allow M = N variants at all. Should that be addressed?
> 
> "These variants" is supposed to be M=N where you pick the point or the
> per user one.

Should the spec provide fixed points for M = N, or a recommendation
to use the provided N (or M) on both sides? It feels important for
interoperability.