Re: [CFRG] HPKE and Key Wrapping

   Hi John,

   There is a very nice critique of AES-KW (which is also defined in the 
X9.102
draft as well as the RFCs you mention) in Appendix A of the Rogaway and 
Shrimpton
paper that defined SIV. To sum:

     "[O]ur conclusion is that none of the X9.102 algorithms are mature. 
Most
      severely, none has been proven secure—and, prior to this paper, there
      was not even a clear target for a security proof. Each scheme has 
multiple
      problems from among the following: a restricted message space; an 
inability
      to handle an associated header; a restricted header space; ciphertext
      lengths that grow with the header length (even though the header 
is only
      authenticated); a large number of blockcipher calls; mysterious 
aspects of
      the construction (eg, the byte-reversals or xoring-in counters); 
and use
      of cryptographic primitives beyond a blockcipher. For a modern 
encryption
      scheme one might reasonably hope for a formally defined and 
provably achieved
      security goal, an aesthetic construction coming out of an 
enunciated paradigm,
      message headers being supported and the message space and header 
space being
      large and natural sets, message expansion of some fixed value, one 
or two
      blockcipher calls per block, and further efficiency 
characteristics (like
      being able to cheaply handle static headers)."

It's also worth noting that AES-KW suffers from the same issue that was 
brought
up when I mentioned using AES-SIV in HPKE: it is stateless and 
deterministic and
therefore it is not really possible to achieve indistinguishability of 
ciphertexts
under an adaptive chosen ciphertext attack, which is what HPKE is 
supposed to
provide.

   You're right that AES-SIV is not approved by NIST. I discussed this 
with NIST
a decade ago and there is an effective catch-22 in which NIST doesn't 
want to
spend cycles analyzing and approving a cipher mode that is not specified 
in any
standards and standards bodies are loath to specify cipher modes that 
have not
been NIST approved. AES-SIV was formally submitted to NIST but no action has
been taken, yet I persist (in trying to get NIST to approve AES-SIV).

   So while I think that AES-SIV is an improvement over AES-KW for the 
purposes
of key wrapping (it's faster, and it's provably secure) if you want to 
use HPKE
for key wrapping you don't even need a key wrapping cipher mode, just do 
AES-GCM
in the "one shot" HPKE variant. Wouldn't that work?

   regards,

   Dan.

On 3/29/22 2:05 AM, John Mattsson wrote:
>
> Hi,
>
> Dan Harkins draft and presentation made me think about HPKE and key 
> wrapping.
>
> https://datatracker.ietf.org/doc/html/draft-harkins-cfrg-dnhpke-01
>
> AES-SIV could be used for this, but the algorithms currently approved 
> by NIST for key wrapping are AES-KW and AES-KWP.
>
> https://datatracker.ietf.org/doc/html/rfc3394
>
> https://datatracker.ietf.org/doc/html/rfc5649
>
> https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf
>
> For asymmetric key wrapping. AES-KWP is often used with RSA-OAEP 
> (which NIST calls KTS-OAEP: Key-Transport Using RSA-OAEP in SP 800-56Br2).
>
> https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Br2.pdf
>
> https://cloud.google.com/kms/docs/key-wrapping
>
> https://microsoft.github.io/CCF/release/1.x/js/ccf-app/interfaces/global.rsaoaepaeskwpparams.html
>
> I think HPKE is the future of asymmetric encryption including 
> asymmetric key wrapping.
>
> Would it make sense to standardize AES-KWP for HPKE or do CFRG believe 
> that AES-SIV is the future of key wrapping? Irrespectively I think the 
> CFRF should produce a good recommendation on how to use HPKE for key 
> wrapping.
>
> Cheers,
>
> John
>
>
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg

-- 
"The object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." -- Marcus Aurelius