4 ms·

I don't see what the problem is, exactly. If you have a secure hash function taking some string into a point of elliptic curve E, multiplying said point by the

by pbsd 12y ago

I don't see what the problem is, exactly. If you have a secure hash function taking some string into a point of elliptic curve E, multiplying said point by the cofactor is also a secure hash function into the relevant subgroup of E. See §6.1 of [1]. [1] https://eprint.iacr.org/2009/340 https://eprint.iacr.org/2009/340

nly 12y ago
Neat. It's also pointed out in Icarts paper[0] that the naive 'try and increment' algorithm, which I believe is utilised in Yongge Wangs draft EC-SRP proposal I linked up above, is vulnerable to timing attacks. Oops Interestingly, both Dragonfly and TLS-SRP describe a 'Hunting and Pecking' algorithm to paper over this problem. Perhaps Icarts solution would be more elegant [0] https://www.iacr.org/archive/crypto2009/56770300/56770300.pdf https://www.iacr.org/archive/crypto2009/56770300/56770300.pd...
- pbsd 12y ago
  Hunting-and-pecking is essentially the same algorithm as try-and-increment, where instead of incrementing an x-coordinate on failure one picks another x (pseudo-)randomly. Therefore both are susceptible to the same kind of timing attacks. Dragonfly went to some pains to try to make the process side-channel-free, but it looks ugly as sin, and it's still unclear whether it is actually secure (cf [1]). [1] https://www.ietf.org/mail-archive/web/cfrg/current/msg03537.html https://www.ietf.org/mail-archive/web/cfrg/current/msg03537....
  - nly 12y ago
    Thanks for that. The tone of Dan Harkins reply is fun. There's clearly a lot of ego in crypto ;) Not sure I see the point in balanced PAKE myself. If you turn weak passwords in to preshared keys then why not just use strong preshared keys to begin with and trust in the bits? Worrying about parameter binding to the verifier seems irrelevant to EC as well.
    - pbsd 12y ago
      I'm probably not the best person to argue in favor of one flavor or another of PAKE, but balanced schemes give you forward security whereas a naive preshared-key scheme does not.
nullc 12y ago
> If you have a secure hash function taking some string into a point of elliptic curve E, multiplying said point by the cofactor is also a secure hash function into the relevant subgroup of E. Fair enough. Though this requires an additional multiplication (at least it's a cheap one). I'm pretty sure some protocols have missed this.

by pbsd 12y ago

nly 12y ago

Neat. It's also pointed out in Icarts paper[0] that the naive 'try and increment' algorithm, which I believe is utilised in Yongge Wangs draft EC-SRP proposal I linked up above, is vulnerable to timing attacks. Oops Interestingly, both Dragonfly and TLS-SRP describe a 'Hunting and Pecking' algorithm to paper over this problem. Perhaps Icarts solution would be more elegant [0] https://www.iacr.org/archive/crypto2009/56770300/56770300.pdf https://www.iacr.org/archive/crypto2009/56770300/56770300.pd...

pbsd 12y ago
Hunting-and-pecking is essentially the same algorithm as try-and-increment, where instead of incrementing an x-coordinate on failure one picks another x (pseudo-)randomly. Therefore both are susceptible to the same kind of timing attacks. Dragonfly went to some pains to try to make the process side-channel-free, but it looks ugly as sin, and it's still unclear whether it is actually secure (cf [1]). [1] https://www.ietf.org/mail-archive/web/cfrg/current/msg03537.html https://www.ietf.org/mail-archive/web/cfrg/current/msg03537....
- nly 12y ago
  Thanks for that. The tone of Dan Harkins reply is fun. There's clearly a lot of ego in crypto ;) Not sure I see the point in balanced PAKE myself. If you turn weak passwords in to preshared keys then why not just use strong preshared keys to begin with and trust in the bits? Worrying about parameter binding to the verifier seems irrelevant to EC as well.
  - pbsd 12y ago
    I'm probably not the best person to argue in favor of one flavor or another of PAKE, but balanced schemes give you forward security whereas a naive preshared-key scheme does not.

nullc 12y ago

> If you have a secure hash function taking some string into a point of elliptic curve E, multiplying said point by the cofactor is also a secure hash function into the relevant subgroup of E. Fair enough. Though this requires an additional multiplication (at least it's a cheap one). I'm pretty sure some protocols have missed this.