Subject: [TLS] Remarks on draft-shin-tls-augpake-01

From: Watson Ladd <[email-masked]>
Date: Tue, 7 Jan 2014 10:11:36 -0800

Given that Dragonfly refuses to die, I think it is worth considering
AugPAKE. I've changed my mind about the necessity: the IoT people want
it badly, and if we don't do this, it will be Dragonfly.

The only issue I see is the draft needs to be made group agnostic and
work on some sufficiently big ECC group. That's a straightforward, if
tedious, change of notation.

Sincerely,
Watson Ladd

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 7 Jan 2014 22:55:08 +0200

> tedious, change of notation.

Also, there are interesting elliptic groups it would need to work over
that don't have h=1, but still have small h (e.g. M-series groups have
h=8, E-series has IIRC h=4).

Would checking for elements with small orders be enough (I think no
seriously considered group would have more than 8 of those)?

The check in current spec that certain values are not -1, 0 or 1 can be
seen as that sort of check, since those are the only values of small
order (and 0 is just plain invalid)...

Oh, and don't forget checks that point decompression succeeds[1] or that
claimed point is on the curve (for uncompressed representation).

[1] Certain square-root/curve implementations lead to twist attacks by
sending invalid compressed points. Some others lead into a mess I don't
know how what to make of[2]).

[2] But probably it isn't good.

-Ilari

---

From: Watson Ladd <[email-masked]>
Date: Tue, 7 Jan 2014 13:10:44 -0800

> seriously considered group would have more than 8 of those)?

Checking membership in [l]E(F_p) is expensive (1 exponentiation), but
would definitely do the job.

> order (and 0 is just plain invalid)...
These are contributory tests.
> claimed point is on the curve (for uncompressed representation).

Isn't this part of implementing any cryptography?

I can't speak for the authors, not being one of them, but I doubt this
sort of statement
would meet with strong opposition.

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin