[noise] Indistinguishable ephemerals plus PAKE (was: PAKE in Noise)

[Trevor Perrin]

On Tue, Jan 15, 2019 at 12:45 AM Ximin Luo <ximin at dfinity.org> wrote:
>
> There is an additional issue with Elligator which is that not all curve points get mapped from a string.

I talked with Ximin and realize he's talking about using Elligator for
indistinguishability purposes, not just using it for masking the
ephemeral.

For indistinguishability we might be better off using "Elligator
Squared", which doubles the public-key size but is capable of encoding
all points (unlike Elligator1 / Elligator2):

https://eprint.iacr.org/2014/043.pdf

Then we could just apply this "on top" of a PAKE to encode/decode the
ephemeral (or masked ephemeral, in PAKE case).  Unlike with original
Elligator, we wouldn't have to modify ephemeral generation and think
about how this affects other things (like PAKE).

Trevor