From nobody Tue Jul 13 09:44:12 2021 Return-Path: X-Original-To: cfrg@ietfa.amsl.com Delivered-To: cfrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B660D3A0924 for ; Tue, 13 Jul 2021 09:44:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.798 X-Spam-Level: X-Spam-Status: No, score=-2.798 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=heapingbits.net header.b=ZJTfOy4v; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=runUrYO7 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7C4AZcrwO5cf for ; Tue, 13 Jul 2021 09:44:02 -0700 (PDT) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 918173A091C for ; Tue, 13 Jul 2021 09:44:02 -0700 (PDT) Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id 7D90D5C0110 for ; Tue, 13 Jul 2021 12:44:01 -0400 (EDT) Received: from imap41 ([10.202.2.91]) by compute5.internal (MEProxy); Tue, 13 Jul 2021 12:44:01 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heapingbits.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type:content-transfer-encoding; s=fm1; bh=G6NwP P1Efrk2uN/a3N4hY2S/qfN2lo+KWqsDdE3H04U=; b=ZJTfOy4vquRJ9Gr61ys3m y19LXFdma6lqOsEInSHkbHya1Z69XHtUBlWq+vMsmF2FYkrQ7D0ejYgLGBdIQqvL fLRsgZQ3y12odhLl3+Cn1LhAZU2EYvdKiPRavaXFr8mbR2qUHBUNE00sqtC0LbA2 DQIfocLWSHLMLKnNv9O1nOqQq2mgsYMlOH9s/XkCkG9gmQAPIjvyZgcfiUwXDGGf O5fabvDBE+Y9Xmf1r6njMBgCUaG6zGe8Hc5Ms6GfAZCBT12IUwEDvh+Ym4QRL8R4 ZlraZ34yi4lJdL+bdjQTOL2Z17HH8EH+WS6jNzjzSG7s/ULYQbxm5zrKY5rq4RWy w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; bh=G6NwPP1Efrk2uN/a3N4hY2S/qfN2lo+KWqsDdE3H0 4U=; b=runUrYO7zcQFp/FAmH3ZdUwp3HgQbE/xxYmTdUVEbG3ulTEMVHORDKbnV 31+EtHI5Fi6jXrLgKoYy2qFW3B8IEosItY/miksmbeHi2nLk/U7HIxK0e5x++9vg U6urKrTj7kCdN9otkKM/3MIpRj2GZ9uApz5BB8tdCyp1G9JeqlPIZpfcT0GEaogQ pfmhM4zs2hMpoHZEcw+1YXdgi8tIoZbhKnS3faA0TGGbm9KCaCW8jgir3fuWJ2m/ HSmZJWHKFATgfk08jdkm9HtY4RjpaRDaNRWs6DJ4czWjvsYIXP6rClfLfJi1FUnI N6WrKp8/3NCBMaencMEN1dOMnx61Q== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvtddrudehgdelfecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgfgsehtqh ertderreejnecuhfhrohhmpedfvehhrhhishhtohhphhgvrhcuhghoohgufdcuoegtrgif sehhvggrphhinhhgsghithhsrdhnvghtqeenucggtffrrghtthgvrhhnpeeltdeludejgf ellefhhfdvgfejfefghfefgffffeeuheekueeuffeiffeijeeutdenucffohhmrghinhep ghhithhhuhgsrdgtohhmpdhivghtfhdrohhrghdpihhrthhfrdhorhhgnecuvehluhhsth gvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomheptggrfieshhgvrghpihhn ghgsihhtshdrnhgvth X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 03D053C0B04; Tue, 13 Jul 2021 12:44:01 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.5.0-alpha0-533-gf73e617b8a-fm-20210712.002-gf73e617b Mime-Version: 1.0 Message-Id: In-Reply-To: <5db11a21-a519-149b-3b14-6a7249e713d3@inria.fr> References: <162567329247.15923.4311477568566128956@ietfa.amsl.com> <856d159d-1b7e-ee22-a1da-32b78704da54@lounge.org> <0e12f957-3472-84b9-e152-8372ae520535@lounge.org> <5db11a21-a519-149b-3b14-6a7249e713d3@inria.fr> Date: Tue, 13 Jul 2021 09:43:40 -0700 From: "Christopher Wood" To: cfrg@irtf.org Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [CFRG] I-D Action: draft-irtf-cfrg-hpke-10.txt X-BeenThere: cfrg@irtf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Crypto Forum Research Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Jul 2021 16:44:09 -0000 Hi Dan, all, FYI, we just merged this PR to clarify the editorial change: https://github.com/cfrg/draft-irtf-cfrg-hpke/pull/233 We'll cut a new version of the draft ASAP. Best, Chris On Tue, Jul 13, 2021, at 3:58 AM, Benjamin Lipp wrote: > Hi Dan, >=20 > On 12/07/2021 23:53, Dan Harkins wrote: > > =C2=A0 I've been having trouble with my mailer and I see in the arch= ives you > > responded > > but it's not getting successfully delivered. >=20 > That is probably my fault =E2=80=93 I first tried to post to the list = from the > wrong sender address and so you have probably received my mail twice. > Sorry for that. >=20 >=20 > > The text that's been there for a while talks about the construction = defined > > in the draft. And yes, use those KEMs and those KDFs and those AEADs= and > > that's what you get. > >=20 > > But now the draft says, > >=20 > > "Future specifications may introduce new KEM, KDF, and AEAD algori= thm > > identifiers provided they adhere to the security requirements in = Section > > 9.2, Section 9.3, and Section 9.4, respectively." > >=20 > > And then 9.4 says all AEADs MUST provide IND-CCA2. > >=20 > > So my reading is that future specifications, like DNHPKE, can intr= oduce > > a new AEAD algorithm, which I want to do, provided it provides IND-C= CA2, > > which SIV does not.=20 >=20 > I see now what you mean. I agree the phrasing is problematic or at lea= st > inconvenient if we indeed want to keep the possibility open that some > variants of HPKE do not provide IND-CCA2 but something else/weaker. > Thanks for clarifying. >=20 >=20 > > If that is your intent I think it can be phrased differently. For = instance, > > the text in section 7 could be re-written something like: > >=20 > > "The HPKE construct defined here provides IND-CCA2. Future specifi= cations > > may introduce new KEM, KDF, and AEAD algorithm identifiers and re= tain this > > security guarantee provided they adhere to the requirements in Se= ction 9.2, > > Section 9.3, and Section 9.4, respectively." > >=20 > > That way it's clear that the intent is to keep the guarantee you nee= d all > > the right parts together and if you don't keep all the parts togethe= r you > > don't get the guarantee. >=20 > Thanks for this suggestion. >=20 > I'll bring it to the attention of my co-authors such that we can discu= ss > what the intent actually was. >=20 > Best regards, > Benjamin. >=20 >=20 >=20 >=20 >=20 > > On 7/12/21 9:39 AM, Dan Harkins wrote: > >> > >> =C2=A0 Hello, > >> > >> =C2=A0 -10 includes a new section, 9.4, that says: > >> > >> =C2=A0=C2=A0=C2=A0=C2=A0 "All AEADs MUST be IND-CCA2-secure, as is = currently true for all > >> AEADs > >> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 listed in Section 7.3" > >> > >> I don't believe this was discussed on the list and I don't agree wi= th it. > >> Using the AEADs in section 7.3 will give you a construction that is= > >> IND-CCA2 > >> secure but I don't think that all uses of HPKE MUST be. > >> > >> =C2=A0 I have a draft on adding support for deterministic authentic= ated > >> encryption > >> to HPKE and this subtle addition to -10 closes the door on that. Si= nce > >> we did > >> not discuss this addition I'd like to start discussing it before th= is > >> draft > >> gets too far. > >> > >> =C2=A0 regards, > >> > >> =C2=A0 Dan. > >> > >> On 7/7/21 8:54 AM, internet-drafts@ietf.org wrote: > >>> A New Internet-Draft is available from the on-line Internet-Drafts= > >>> directories. > >>> This draft is a work item of the Crypto Forum RG of the IRTF. > >>> > >>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Title=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 : Hybrid Public Key Enc= ryption > >>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Authors=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 : Richard L. Barnes > >>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Karthik Bhargavan > >>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Benjamin Lipp > >>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Christopher A. Wood > >>> =C2=A0=C2=A0=C2=A0=C2=A0Filename=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0 : draft-irtf-cfrg-hpke-10.txt > >>> =C2=A0=C2=A0=C2=A0=C2=A0Pages=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0 : 104 > >>> =C2=A0=C2=A0=C2=A0=C2=A0Date=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0 : 2021-07-07 > >>> > >>> Abstract: > >>> =C2=A0=C2=A0=C2=A0 This document describes a scheme for hybrid pub= lic-key encryption > >>> =C2=A0=C2=A0=C2=A0 (HPKE).=C2=A0 This scheme provides a variant of= public-key encryption of > >>> =C2=A0=C2=A0=C2=A0 arbitrary-sized plaintexts for a recipient publ= ic key.=C2=A0 It also > >>> =C2=A0=C2=A0=C2=A0 includes three authenticated variants, includin= g one which > >>> =C2=A0=C2=A0=C2=A0 authenticates possession of a pre-shared key, a= nd two optional ones > >>> =C2=A0=C2=A0=C2=A0 which authenticate possession of a KEM private = key.=C2=A0 HPKE works for > >>> =C2=A0=C2=A0=C2=A0 any combination of an asymmetric key encapsulat= ion mechanism (KEM), > >>> =C2=A0=C2=A0=C2=A0 key derivation function (KDF), and authenticate= d encryption with > >>> =C2=A0=C2=A0=C2=A0 additional data (AEAD) encryption function.=C2=A0= Some authenticated > >>> =C2=A0=C2=A0=C2=A0 variants may not be supported by all KEMs.=C2=A0= We provide > >>> instantiations > >>> =C2=A0=C2=A0=C2=A0 of the scheme using widely used and efficient p= rimitives, such as > >>> =C2=A0=C2=A0=C2=A0 Elliptic Curve Diffie-Hellman key agreement, HK= DF, and SHA2. > >>> > >>> =C2=A0=C2=A0=C2=A0 This document is a product of the Crypto Forum = Research Group (CFRG) > >>> =C2=A0=C2=A0=C2=A0 in the IRTF. > >>> > >>> > >>> The IETF datatracker status page for this draft is: > >>> https://datatracker.ietf.org/doc/draft-irtf-cfrg-hpke/ > >>> > >>> There is also an HTML version available at: > >>> https://www.ietf.org/archive/id/draft-irtf-cfrg-hpke-10.html > >>> > >>> A diff from the previous version is available at: > >>> https://www.ietf.org/rfcdiff?url2=3Ddraft-irtf-cfrg-hpke-10 > >>> > >>> > >>> Internet-Drafts are also available by anonymous FTP at: > >>> ftp://ftp.ietf.org/internet-drafts/ > >>> > >>> > >>> _______________________________________________ > >>> CFRG mailing list > >>> CFRG@irtf.org > >>> https://www.irtf.org/mailman/listinfo/cfrg > >> > >=20 > > --=20 > > "The object of life is not to be on the side of the majority, but to= > > escape finding oneself in the ranks of the insane." -- Marcus Aureli= us > >=20 >=20 > _______________________________________________ > CFRG mailing list > CFRG@irtf.org > https://www.irtf.org/mailman/listinfo/cfrg >=20