Re: [Cfrg] Multi-recipient public key authenticated encryption

[Peter Gutmann <[e-mail]>]

Neil Madden <[e-mail]> writes:

>Given that many uses of this sign-then-encrypt pattern do not require the
>strong security properties of signatures, I have proposed [1] a public key
>authenticated encryption mode based on NIST’s one-pass unified model from SP
>800-56A. This avoids the nested structure and means that you don’t need
>multiple cryptographic primitives. The proposed algorithm uses two ECDH key
>agreements: one between the sender’s ephemeral private key and the
>recipient’s long-term public key; and a second between the two parties’ long
>term keys. The two shared secrets are concatenated and passed through a KDF
>along with some context arguments. For a single recipient this achieves
>sender authentication (subject to replay), and the single recipient case is
>what I am primarily concerned about.

Maybe I'm missing something about JOSE here, but rather than introducing
complex and exotic new encryption modes, couldn't you just define a signed +
encrypted message format like PGP and S/MIME have been using for thirty years
now?

Peter.