Re: [CFRG] HPKE and Key Wrapping

This thread seems pretty confused.  For purposes of RNG resilience, it
doesn't matter if you use AES-SIV, AES-GCM, or GOST 28147-89 -- none of the
symmetric algorithms are fed by an RNG in HPKE.   The symmetric parameters
are all determined based on the KEM interaction.

So if you want HPKE to survive in a model where you assume the RNG is
compromised, you'll need a KEM that is OK in that model.  And given the
IND-CCA2 requirement and the API, it seems like Encap(pkR) is inevitably
going to rely on an RNG.

--RLB

On Wed, Mar 30, 2022 at 2:10 PM Blumenthal, Uri - 0553 - MITLL <
uri@ll.mit.edu> wrote:

> Key wrapping mechanisms has in the past tried to provide security even in
> the case of compromised RNG and state. To keep that attack model, I think
> HPKE would need to be augmented with something like AES-KWP, AES-SIV, or
> AES-GCM-SIV.
>
>
>
> +1
>
>
>
> AES-SIV may be better with nonce reuse than AES-GCM-SIV (based on Taylor’s
> analysis), but either one would be OK from cryptographic point of view.
>
>
>
> I would personally chose the algorithm with the best properties over NIST
> approval stamp (HPKE is not NIST approved either). I think it makes sense
> for CFRG to add AES-SIV and/or AES-GCM-SIV to HPKE.
>
>
>
> I have to agree. It makes perfect sense to add AES-SIV and/or AES-GCM-SIV.
> (I could probably live with Deoxys-II-256 from CAESAR competition as well)
>
>
>
> Unfortunately, NIST approval stamp on cipher modes seems to have lost its
> relevance. Note that despite multiple requests, NIST has yet to “approve” a
> nonce misuse-resistant mode – so far they’ve been saying “no” or “we’re
> thinking about it”.   <Sigh>
>
>
>
> Thanks!
>
>
>
> *From: *CFRG <cfrg-bounces@irtf.org> on behalf of Martin Thomson <
> mt@lowentropy.net>
> *Date: *Wednesday, 30 March 2022 at 02:32
> *To: *cfrg@irtf.org <cfrg@irtf.org>
> *Subject: *Re: [CFRG] HPKE and Key Wrapping
>
> On Tue, Mar 29, 2022, at 20:05, John Mattsson wrote:
> > Would it make sense to standardize AES-KWP for HPKE or do CFRG believe
> > that AES-SIV is the future of key wrapping? Irrespectively I think the
> > CFRF should produce a good recommendation on how to use HPKE for key
> > wrapping.
>
> What is wrong with the existing HPKE cipher suites for protecting keying
> materials?  That is, aside from not carrying a NIST approval stamp.
>
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
>
> https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-40f7d10cf9eb7c69&q=1&e=c95f3aec-4703-4832-9b62-2c7a79363887&u=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>