Re: [CFRG] HPKE and Key Wrapping

[John Mattsson <[e-mail]>]

Hi Martin,

>What is wrong with the existing HPKE cipher suites for protecting keying materials?  That >is, aside from not carrying a NIST approval stamp.

See my mail to Dan
https://mailarchive.ietf.org/arch/msg/cfrg/ID0JuUDIg7np4CxMZLq-7Zuaj40/

Key wrapping mechanisms has in the past tried to provide security even in the case of compromised RNG and state. To keep that attack model, I think HPKE would need to be augmented with something like AES-KWP, AES-SIV, or AES-GCM-SIV.

I would personally chose the algorithm with the best properties over NIST approval stamp (HPKE is not NIST approved either). I think it makes sense for CFRG to add AES-SIV and/or AES-GCM-SIV to HPKE.

Cheers,
John

From: CFRG <[e-mail]> on behalf of Martin Thomson <[e-mail]>
Date: Wednesday, 30 March 2022 at 02:32
To: [e-mail] <[e-mail]>
Subject: Re: [CFRG] HPKE and Key Wrapping
On Tue, Mar 29, 2022, at 20:05, John Mattsson wrote:
> Would it make sense to standardize AES-KWP for HPKE or do CFRG believe
> that AES-SIV is the future of key wrapping? Irrespectively I think the
> CFRF should produce a good recommendation on how to use HPKE for key
> wrapping.

What is wrong with the existing HPKE cipher suites for protecting keying materials?  That is, aside from not carrying a NIST approval stamp.

_______________________________________________
CFRG mailing list
[e-mail]
https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-40f7d10cf9eb7c69&q=1&e=c95f3aec-4703-4832-9b62-2c7a79363887&u=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg