Re: [CFRG] DAE for HPKE, was Re: I-D Action: draft-irtf-cfrg-dnhpke-02.txt

[Dan Harkins <[e-mail]>]

   Hi Eric,

On 10/1/23 2:15 PM, Eric Rescorla wrote:
> On Fri, Sep 29, 2023 at 12:02 PM Dan Harkins <[e-mail]> wrote:
>
>
>        Hello,
>
>        First of all, there's a new version of draft-irtf-cfrg-dnhpke out.
>     Please take a look.
>
>        At IETF 116 I was told I could get IANA assigned values without
>     the draft becoming an RFC so I applied. I got KEM assignments for
>     compressed output but the experts are refusing to approve assignment
>     for DAE support because it's not IND-CCA2.
>
>        So let me digress briefly....
>
>        In [1], I noted that this requirement that "all AEADs must be
>     IND-CCA2 secure" appeared in -10 of the HPKE I-D without any real
>     discussion (it wasn't in -09 and there was no discussion on the
>     list) and that I was concerned that they were closing the door on
>     my proposal. But I was told in [2] by an author of HPKE, and the
>     guy who did the security analysis, that the door wasn't closed and
>     that adding new DAE ciphers which were not IND-CCA2 did not affect
>     the existing ciphers which were. There was even a pull request for
>     HPKE to clarify (see [3]) which I was under the impression allowed
>     for addition of new ciphers which were not IND-CCA2 since they were
>     not diluting existing security guarantees.
>
>        But now I'm being told by the experts that there is an absolute
>     prohibition on using HPKE with a cipher which is not IND-CCA2. I
>     believe that is incorrect and certainly that was not part of the
>     RGLC approval of the HPKE I-D.
>
>        I would like to hear what other people think and would like the
>     experts to be overruled and to approve assignment of the DAE ciphers
>     defined in draft-irtf-cfrg-dnhpke-02.
>
>
> Without taking a position on the merits of this issue, it's not clear 
> to me that CFRG can in fact overrule the experts. Here is what RFC 
> 8126 says about appeals of registration decisions 
> (https://datatracker.ietf.org/doc/html/rfc8126#section-10):
> Appeals of protocol parameter registration decisions can be made using 
> the normal IETF appeals process as described in [RFC2026], Section 6.5 
> <https://datatracker.ietf.org/doc/html/rfc2026#section-6.5>. That is, 
> an initial appeal should be directed to the IESG, followed (if 
> necessary) by an appeal to the IAB.
> That does seem a bit odd for a registry created by an IRTF document, 
> but nevertheless, I think the process would require you to take it to 
> the IESG.

   My point is that the experts are wrong in their interpretation of 
what RFC 9180
says. There was discussion on the list about forbidding determinstic AE 
cipher
modes and one of the editors (who I believe is also the guy who did the 
security
analysis) said they weren't prohibited. The editors even agreed to a 
pull request
to clarify this. It was certainly presented as "door not closed" when 
discussed in
RGLC, yet when RFC 9180 comes out the experts say "door is closed". So I
believe they are enforcing a rule that the RG was told was not there 
prior to
publication. If the RG agrees then I do not think this prohibition 
exists and
the experts are mistaken in their reading of the RFC.

   I do appreciate you pointing out the appeals process though. It may come
to that.

   regards,

   Dan.

> -Ekr
>
>        thanks and regards,
>
>        Dan.
>
>     [1]
>     https://mailarchive.ietf.org/arch/msg/cfrg/dAhw4TluqDfzKvtatqXvXbW0GVY/
>     [2]
>     https://mailarchive.ietf.org/arch/msg/cfrg/MOMY2a3srTUpgW2F_76kySv5IKw/
>     [3] https://github.com/cfrg/draft-irtf-cfrg-hpke/pull/233
>
>     On 9/28/23 11:41 AM, [e-mail] wrote:
>     > Internet-Draft draft-irtf-cfrg-dnhpke-02.txt is now available.
>     It is a work
>     > item of the Crypto Forum (CFRG) RG of the IRTF.
>     >
>     >     Title:   Deterministic Nonce-less Hybrid Public Key Encryption
>     >     Author:  Dan Harkins
>     >     Name:    draft-irtf-cfrg-dnhpke-02.txt
>     >     Pages:   38
>     >     Dates:   2023-09-28
>     >
>     > Abstract:
>     >
>     >     This document describes enhancements to the Hybrid Public Key
>     >     Encryption standard published by CFRG.  These include use of
>     "compact
>     >     representation" of relevant public keys, support for
>     key-wrapping,
>     >     and two ways to address the use of HPKE on lossy networks: a
>     >     determinstic, nonce-less AEAD scheme, and use of a rolling
>     sequence
>     >     number with existing AEAD schemes.
>     >
>     > The IETF datatracker status page for this Internet-Draft is:
>     > https://datatracker.ietf.org/doc/draft-irtf-cfrg-dnhpke/
>     >
>     > There is also an HTMLized version available at:
>     > https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-dnhpke-02
>     >
>     > A diff from the previous version is available at:
>     > https://author-tools.ietf.org/iddiff?url2=draft-irtf-cfrg-dnhpke-02
>     >
>     > Internet-Drafts are also available by rsync at:
>     > rsync.ietf.org::internet-drafts
>     >
>     >
>     > _______________________________________________
>     > CFRG mailing list
>     > [e-mail]
>     > https://www.irtf.org/mailman/listinfo/cfrg
>
>     -- 
>     "The object of life is not to be on the side of the majority, but to
>     escape finding oneself in the ranks of the insane." -- Marcus Aurelius
>
>     _______________________________________________
>     CFRG mailing list
>     [e-mail]
>     https://www.irtf.org/mailman/listinfo/cfrg
>

-- 
"The object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." -- Marcus Aurelius