I am trying to write a simulation of the SPAKE2 protocol in python (just so I can get a better understanding of the protocol altogether). I am reading through the ietf draft here: Datatracker.

There's a lot about cryptography I do not understand though and I am having trouble figuring out how to generate some of the values mentioned in the setup. Here is the excerpt I am talking about:

Let G be a group in which the computational Diffie-Hellman (CDH) problem is hard. Suppose G has order p*h where p is a large prime; h will be called the cofactor. Let I be the unit element in G, e.g., the point at infinity if G is an elliptic curve group. We denote the operations in the group additively. We assume there is a representation of elements of G as byte strings: common choices would be SEC1 compressed [SEC1] for elliptic curve groups or big endian integers of a fixed (pergroup) length for prime field DH. We fix two elements M and N in the prime-order subgroup of G as defined in the table in this document for common groups, as well as a generator P of the (large) prime-order subgroup of G. P is specified in the document defining the group, and so we do not repeat it here.

More specifically, I don't know how to generate G, p, h, M, N, or P and I don't have the mathematical understanding to know exactly what those values are supposed to be. I would really appreciate any help or guidance.

  • $\begingroup$ You don't need generate all of them. Choose an elliptic curve like Curve25519, sepk256k1, etc. then the parameters $G,p,h$ and $P$ are already determined. $\endgroup$
    – kelalaka
    Nov 25 '19 at 20:04
  • 1
    $\begingroup$ Or just read the draft - it gives all the parameters... $\endgroup$
    – poncho
    Nov 25 '19 at 20:57
  • 1
    $\begingroup$ @kansas_bulldog382 in Elliptic Curve if affine coordinates are used then every point is represented by a pair $(u,v)$ $\endgroup$
    – kelalaka
    Nov 26 '19 at 2:12
  • 1
    $\begingroup$ @kansas_bulldog382 that is called scalar multiplication with an example.. $\endgroup$
    – kelalaka
    Nov 26 '19 at 7:59
  • 1
    $\begingroup$ Also, if you are using Curve25519, most existing libraries may "clamp" the scalar (clear the 3 low bits, set the high bit), which can give you trouble when implementing SPAKE2. Make sure that this doesn't happen (for example in libsodium by using scalarmult_ed25519_base_noclamp() and scalarmult_ed25519_noclamp() - See github.com/jedisct1/spake2-ee for an example implementation (although that one is an augmented version, and has a different way to choose M and N). $\endgroup$ Nov 26 '19 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.