<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Er, you would compute A’ = mul(8*a, elligator(c)). That is, you don’t also have to multiply by c.<div class=""><br class=""></div><div class="">Whoops,</div><div class="">— Mike<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jan 24, 2018, at 12:56 PM, Mike Hamburg <<a href="mailto:mike@shiftleft.org" class="">mike@shiftleft.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">It’s not safe against dictionary attacks by Alice or Bob. For that, you want SPEKE, SPAKE2, PAK, …<div class=""><br class=""></div><div class="">This is a variant of SPEKE. To make it secure you would compute A = mul(8*a, elligator(c)) and B = mul(8*b, elligator(c)) instead of what you have here, and also hash elligator(c) in the final MA/MB computation, in addition to adding identities or something to address Katriel’s concern.</div><div class=""><br class=""></div><div class="">— Mike</div><div class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On Jan 24, 2018, at 3:37 AM, Katriel Cohn-Gordon <<a href="mailto:me@katriel.co.uk" class="">me@katriel.co.uk</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: georgia, serif;" class="">What does "safe" mean in this context?<br class=""></div><div style="font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: georgia, serif;" class=""><br class=""></div><div style="font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: georgia, serif;" class="">For example, an adversary could reflect Alice's initial message back to Alice, and then reflect the hash back as well. The result is that Alice will complete a protocol execution without Bob even existing. Is that bad?<br class=""></div><div style="font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: georgia, serif;" class=""><br class=""></div><div style="font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: georgia, serif;" class="">Katriel</div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">On Wed, 24 Jan 2018, at 10:45 AM, Van Gegel wrote:<br class=""></div><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><div style="font-family: georgia, serif;" class=""><span class="">Hi all!<br class="">Please advise on this protocol:<br class=""><br class="">Two parties comparing 2 bytes short common secret using EC25519 (only mul and mul_base procedures) and SHA3 hash.<br class="">Any side can be active adversary trying obtain secret.<br class=""><br class="">c = H(secret)<br class=""><br class="">Side A:<br class="">- picks a at random<br class="">- computes A = mul_base(a)<br class="">- computes A' = mul(c, A)<br class="">- sends A' to side B<br class=""><br class="">Side B:<br class="">- picks b at random<br class="">- computes B = mul_base(b)<br class="">- computes B' = mul(c, B)<br class="">- sends B' to side A<br class=""><br class="">Side A:<br class="">- computes S = mul(a, B')<br class="">- sends MB=H(A' | B' | S) to side A<br class=""><br class="">Side B:<br class="">- computes S= mul(b, A')<br class="">- sends MA=H(B' | A' | S) to side B<br class=""><br class="">Both A and B checks MA and MB.<br class=""><br class="">Is this protocol safe?<br class=""></span></div><div class=""><u class="">_______________________________________________</u><br class=""></div><div class="">Messaging mailing list<br class=""></div><div class=""><a href="mailto:Messaging@moderncrypto.org" class="">Messaging@moderncrypto.org</a><br class=""></div><div class=""><a href="https://moderncrypto.org/mailman/listinfo/messaging" class="">https://moderncrypto.org/mailman/listinfo/messaging</a><br class=""></div></blockquote><div style="font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; font-family: georgia, serif;" class=""><br class=""></div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Messaging mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="mailto:Messaging@moderncrypto.org" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">Messaging@moderncrypto.org</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="https://moderncrypto.org/mailman/listinfo/messaging" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://moderncrypto.org/mailman/listinfo/messaging</a></div></blockquote></div><br class=""></div></div></div></blockquote></div><br class=""></div></body></html>