[noise] Indistinguishable ephemerals plus PAKE (was: PAKE in Noise)

Trevor Perrin trevp at trevp.net
Tue Jan 15 01:42:14 PST 2019

On Tue, Jan 15, 2019 at 12:45 AM Ximin Luo <ximin at dfinity.org> wrote:
> There is an additional issue with Elligator which is that not all curve points get mapped from a string.

I talked with Ximin and realize he's talking about using Elligator for
indistinguishability purposes, not just using it for masking the

For indistinguishability we might be better off using "Elligator
Squared", which doubles the public-key size but is capable of encoding
all points (unlike Elligator1 / Elligator2):


Then we could just apply this "on top" of a PAKE to encode/decode the
ephemeral (or masked ephemeral, in PAKE case).  Unlike with original
Elligator, we wouldn't have to modify ephemeral generation and think
about how this affects other things (like PAKE).


More information about the Noise mailing list