Re: [CFRG] compact representation and HPKE

[Karthik Bhargavan <[e-mail]>]

I think the idea of having a compact representation of EC points for use in IoT-like scenarios is an attractive one, but the core ciphersuites of HPKE should only depend on standardized and widely-implemented point formats.

In particular, HPKE is certainly not the right place to standardize a new EC point format, however sensible the change may seem.
A protocol like EDHOC is laser-focused on small wire messages and is meant to be implemented by IoT-specific crypto libraries, and so it makes sense for that protocol to employ such optimizations.
Perhaps the LAKE working group could drive a IETF/CFRG standard for x-only EC point representations that are more generally usable by other protocols?

Having said all that, HPKE is extensible and we do anticipate extensions to HPKE in the near future, notably for adding PQ ciphersuites.
I think the best way to proceed for compact HPKE would be, along the lines of Dan’s suggestion, to propose new KEM algorithm identifiers for compact encodings of the NIST curves, and to do this as part of a new CFRG draft as an extension to HPKE.
I suspect that, beyond the point representation, we may find other parts of HPKE that would benefit from compaction for low-bandwidth scenarios.

Best,
Karthik