Re: [CFRG] DAE for HPKE, was Re: I-D Action: draft-irtf-cfrg-dnhpke-02.txt

[Mike Ounsworth <[e-mail]>]

> The TLS registries have learned that we need to have a notes column, and a recommended-or-not column. Perhaps an update that adds a Note column and the draft could cay “not IND-CCA2”. In fact, the IANA action to add that column could be part of this draft.

I’m with Richard that the label “Not IND-CCA2” includes both otherwise perfectly acceptable DAE ciphers, and also ROT13, and so is not a helpful label in terms of guiding non-cryptographer sysadmins and policymakers.


If we think that the deterministic nonce-less AEADs in draft-irtf-cfrg-dnhpke are ok-ish, then we need a better label than “Not IND-CCA2”.

---
Mike Ounsworth

From: CFRG <[e-mail]> On Behalf Of Salz, Rich
Sent: Monday, October 2, 2023 8:30 AM
To: Richard Barnes <[e-mail]>; Eric Rescorla <[e-mail]>
Cc: [e-mail]
Subject: [EXTERNAL] Re: [CFRG] DAE for HPKE, was Re: I-D Action: draft-irtf-cfrg-dnhpke-02.txt

My interpretation of the question here is: - HPKE has been proven IND-CCA2 secure if the KEM and AEAD are IND-CCA2 secure - RFC 9180 makes no claims about the security of the construction if the AEAD is *not* IND-CCA2 secure - The request here

My interpretation of the question here is:
- HPKE has been proven IND-CCA2 secure if the KEM and AEAD are IND-CCA2 secure
- RFC 9180 makes no claims about the security of the construction if the AEAD is *not* IND-CCA2 secure
- The request here is to register an AEAD algorithm that is affirmatively *not* IND-CCA2 secure (can't be, not even claimed to be)

If this is an accurate summary, then I don’t see a reason for the experts to reject the algorithm.

So the question for the RG is -- Are folks OK with values being registered that do not meet the security requirements in the RFC?

Well, the RFC doesn’t have that requirement.  It says “if X then Y” not “only X is valid.” But I gave it a quick read, so if I’m wrong please point to the section where it says IND-CCA2 is required.

The TLS registries have learned that we need to have a notes column, and a recommended-or-not column. Perhaps an update that adds a Note column and the draft could cay “not IND-CCA2”. In fact, the IANA action to add that column could be part of this draft.


Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.