[Cfrg] PAKE

"Igoe, Kevin M." <kmigoe@nsa.gov> Wed, 02 May 2012 20:07 UTC

Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01CD289F.4097E5A5"
Date: Wed, 02 May 2012 16:07:51 -0400
Message-ID: <80F9AC969A517A4DA0DE3E7CF74CC1BB425BF6@MSIS-GH1-UEA06.corp.nsa.gov>
Thread-Topic: PAKE
Thread-Index: Ac0on0GmoxGRBW5zQZqTViEfntPTMw==
From: "Igoe, Kevin M." <kmigoe@nsa.gov>
To: cfrg@irtf.org, Dan Harkins <dharkins@arubanetworks.com>
Subject: [Cfrg] PAKE
Precedence: list

One quick piece of feedback.  In the EC case, the construction

of the PassWrod Element (PWE) on the curve involves

trying to take the square root of f = x^3 + ax + b.  This

is MUCH easier to do in p = 3 mod 4 (in this case compute

y = f^( (p+1)/4).  If y^2 = f, your done, otherwise y^2 = -f

and f doesn't have a square root mod p.

 

The p = 1 mod 4 case gets ugly, especially if p-1 is divisible

by a high power of 2.   Luckily most EC groups use p=3 mod 4.

 

I'd advise adding the constraint that for eliiptic cureves pmust

be 3 mod 4. 

 

P.S.  The fact that f has a preferred square root mod p might

eliminate the code that decides whether to use (x,y) or

(x,-y) as the PWE.

 

Kevin M. Igoe       |   "Everyone is entitled to their own
kmigoe@nsa.gov <mailto:kmigoe@nsa.gov>   |    opinions, but not to their
own facts."
                           |       - Daniel Patrick Moynihan -

[Cfrg] PAKE Igoe, Kevin M.