Re: [CFRG] [Pqc] [lamps] [EXTERNAL] Re: CMS Kyber: include PK and CT in the KDF?

[Ilari Liusvaara <[e-mail]>]

On Fri, Apr 12, 2024 at 11:49:47AM -0400, Deirdre Connolly wrote:
> > And with regards to implicit key authentication in base mode, is it a
> > problem if one can make a (enc, ct) pair that decrypts under any of
> > private keys corresponding to some given set of multiple public keys?
> 
> Set? HPKE encrypts to a single PK. And if you are encrypting to a
> particular PK but your KEM ct (and thus the HPKE payload) is decryptable by
> /any/ decaps key (which the IND-CCA KEM Classic McEliece allows), you have
> lost implicit authentication.
> 
> https://opensourcecryptowork.shop/2024/Going%20Post-Quantum.pdf
> https://www.youtube.com/watch?v=FaC6OuLDMFE&pp=ygUJY2ZyZyBpZXRm

The way I understand "implicit key authentication" is that if open
call succeeds, then the private key used in call corresponds to the
public key used in the seal call that produced the message.

Alas, the KEM (jointly) being IND-CCA2, MAL-BIND-K-PK and MAL-BIND-K-CT
does not imply this in HPKE.

And HPKE is better-behaved than likes of CMS, JOSE and COSE (which are
pretty much typical for the class).




-Ilari