Re: [CFRG] DAE for HPKE, was Re: I-D Action: draft-irtf-cfrg-dnhpke-02.txt

[Eric Rescorla <[e-mail]>]

On Fri, Sep 29, 2023 at 12:02 PM Dan Harkins <[e-mail]> wrote:

>
>    Hello,
>
>    First of all, there's a new version of draft-irtf-cfrg-dnhpke out.
> Please take a look.
>
>    At IETF 116 I was told I could get IANA assigned values without
> the draft becoming an RFC so I applied. I got KEM assignments for
> compressed output but the experts are refusing to approve assignment
> for DAE support because it's not IND-CCA2.
>
>    So let me digress briefly....
>
>    In [1], I noted that this requirement that "all AEADs must be
> IND-CCA2 secure" appeared in -10 of the HPKE I-D without any real
> discussion (it wasn't in -09 and there was no discussion on the
> list) and that I was concerned that they were closing the door on
> my proposal. But I was told in [2] by an author of HPKE, and the
> guy who did the security analysis, that the door wasn't closed and
> that adding new DAE ciphers which were not IND-CCA2 did not affect
> the existing ciphers which were. There was even a pull request for
> HPKE to clarify (see [3]) which I was under the impression allowed
> for addition of new ciphers which were not IND-CCA2 since they were
> not diluting existing security guarantees.
>
>    But now I'm being told by the experts that there is an absolute
> prohibition on using HPKE with a cipher which is not IND-CCA2. I
> believe that is incorrect and certainly that was not part of the
> RGLC approval of the HPKE I-D.
>
>    I would like to hear what other people think and would like the
> experts to be overruled and to approve assignment of the DAE ciphers
> defined in draft-irtf-cfrg-dnhpke-02.
>

Without taking a position on the merits of this issue, it's not clear to me
that CFRG can in fact overrule the experts. Here is what RFC 8126 says
about appeals of registration decisions (
https://datatracker.ietf.org/doc/html/rfc8126#section-10):

   Appeals of protocol parameter registration decisions can be made
   using the normal IETF appeals process as described in [RFC2026],
   Section 6.5 <https://datatracker.ietf.org/doc/html/rfc2026#section-6.5>.
That is, an initial appeal should be directed to the
   IESG, followed (if necessary) by an appeal to the IAB.

That does seem a bit odd for a registry created by an IRTF document,
but nevertheless, I think the process would require you to take it to
the IESG.

-Ekr



>    thanks and regards,
>
>    Dan.
>
> [1]
> https://mailarchive.ietf.org/arch/msg/cfrg/dAhw4TluqDfzKvtatqXvXbW0GVY/
> [2]
> https://mailarchive.ietf.org/arch/msg/cfrg/MOMY2a3srTUpgW2F_76kySv5IKw/
> [3] https://github.com/cfrg/draft-irtf-cfrg-hpke/pull/233
>
> On 9/28/23 11:41 AM, [e-mail] wrote:
> > Internet-Draft draft-irtf-cfrg-dnhpke-02.txt is now available. It is a
> work
> > item of the Crypto Forum (CFRG) RG of the IRTF.
> >
> >     Title:   Deterministic Nonce-less Hybrid Public Key Encryption
> >     Author:  Dan Harkins
> >     Name:    draft-irtf-cfrg-dnhpke-02.txt
> >     Pages:   38
> >     Dates:   2023-09-28
> >
> > Abstract:
> >
> >     This document describes enhancements to the Hybrid Public Key
> >     Encryption standard published by CFRG.  These include use of "compact
> >     representation" of relevant public keys, support for key-wrapping,
> >     and two ways to address the use of HPKE on lossy networks: a
> >     determinstic, nonce-less AEAD scheme, and use of a rolling sequence
> >     number with existing AEAD schemes.
> >
> > The IETF datatracker status page for this Internet-Draft is:
> > https://datatracker.ietf.org/doc/draft-irtf-cfrg-dnhpke/
> >
> > There is also an HTMLized version available at:
> > https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-dnhpke-02
> >
> > A diff from the previous version is available at:
> > https://author-tools.ietf.org/iddiff?url2=draft-irtf-cfrg-dnhpke-02
> >
> > Internet-Drafts are also available by rsync at:
> > rsync.ietf.org::internet-drafts
> >
> >
> > _______________________________________________
> > CFRG mailing list
> > [e-mail]
> > https://www.irtf.org/mailman/listinfo/cfrg
>
> --
> "The object of life is not to be on the side of the majority, but to
> escape finding oneself in the ranks of the insane." -- Marcus Aurelius
>
> _______________________________________________
> CFRG mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>