Re: [CFRG] compact representation and HPKE

"Stanislav V. Smyshlyaev" <> Tue, 16 February 2021 07:36 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 1ABCB3A0FEC for <>; Mon, 15 Feb 2021 23:36:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id RyNN-hn_lXTI for <>; Mon, 15 Feb 2021 23:36:01 -0800 (PST)
Received: from ( [IPv6:2a00:1450:4864:20::62a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id DCFE03A1043 for <>; Mon, 15 Feb 2021 23:35:58 -0800 (PST)
Received: by with SMTP id w1so14922382ejf.11 for <>; Mon, 15 Feb 2021 23:35:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=AEh9bjUlSi9x2XvNTkCcwIHQ0m1kgdRznMXRLQhF7sQ=; b=Vb5QOzJ9vO+6RnkuZLq2LmrQDpp7gl240lmKIXEQYJYMooPFYW2Q6pHAl/clA27qKW k9Q79Wf21z+Em+uK6kwa8ifvuxw+fxmZSmF8l4wb5OO7oFYUhwIF1YbGTr0Ly2o57N+0 uwPPgz9nTa8fXfYVgbhbX4r6lKwdqXJFkBgEMZfAqYCq4/mLY9QSB1kSyHcdCaE75PM5 aVU4zlKDy28syoaXupg9s/WZMwM49BvkTBTpiq+J7917c2RhDhAAR4DKVZZsbCyBbzd+ 7j/F1cli+0wnwlEs8Lme9yMG24cgS28RVrYb0BiCqqARkgtF03mw4C2d7CKupoORwk1M gzNQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=AEh9bjUlSi9x2XvNTkCcwIHQ0m1kgdRznMXRLQhF7sQ=; b=Dhe76O7+Y6zTdd0r2WjNfzEFNA3CCERCR77MgwcMk64FdiIBm83FUr8N+FlXtmTyWm hrjuLBBjmesAIJcsxxIQ42w5cuh/kEXMNSoPupZWSW7SuHTLHA99IHcu1/JpyPDNjK94 5dVuIK+Nsrpd/g3zs5fgFy6HrB2Gs/CiBjw6VXO4k0uz4uK/utrDdNJOABL2uIPLLtia s4ySUUrR1HOV02Npba8zMX4wr0ixkHy2yGfoYPJHaZQl8GhYZwUYegyKKMCzIWixUX7c TKvk3qqqre1Rq5jNaQxBOtoSWTfn7TY50k/T3qXGamIwTH+WZJw5X7XKkvueMN/aDokz UB4Q==
X-Gm-Message-State: AOAM5311k1kikZuE+anPygAgIvXAk64iQM5ijmuolC2hE+Fa2EeoPFhN VsUQXOxcMlgkzHtQcSN790zcEVBgjlz3evzS8vE=
X-Google-Smtp-Source: ABdhPJxBHDdBOWTMbX8/poLg2Yi8CXo6ihN6bM5RSob+A/r2xV8CTOk0/VsWlP9mlARDJl2s6mnsVfOC30O7awizYt8=
X-Received: by 2002:a17:907:3f13:: with SMTP id hq19mr19353953ejc.142.1613460957251; Mon, 15 Feb 2021 23:35:57 -0800 (PST)
MIME-Version: 1.0
References: <> <> <> <> <> <> <>
In-Reply-To: <>
From: "Stanislav V. Smyshlyaev" <>
Date: Tue, 16 Feb 2021 10:35:40 +0300
Message-ID: <>
To: Dan Harkins <>
Cc: Richard Barnes <>, Karthik Bhargavan <>, CFRG <>
Content-Type: multipart/alternative; boundary="000000000000374eef05bb6f27c8"
Archived-At: <>
Subject: Re: [CFRG] compact representation and HPKE
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 16 Feb 2021 07:36:10 -0000

Dear Dan,

>> I can get an I-D out RSN in the expectation that RGLC finishes
Just a quick comment: the RGLC (the second RGLC) was in August, see,
the HPKE draft is one step before the IRSG review.

>> Yes, I think this is an acceptable way forward.
Thanks, Dan! No objections against moving forward with the HPKE draft now,


On Mon, 15 Feb 2021 at 21:42, Dan Harkins <> wrote:

>   Hello,
> On 2/15/21 8:50 AM, Richard Barnes wrote:
> Hi folks,
> I think Karthik is on the right track here.  While the compact
> representation undoubtedly has its benefits, it seems like there is no
> disagreement that it is not widely supported in either standards or crypto
> libraries.  So there is a sizable community for whom a requirement to use
> the compact format would render HPKE unusable.
> Given that, I would propose we resolve this issue in the following way:
> * In the current document, define KEMs for the NIST curves using the
> uncompressed format.
> * If there is a community that is *also* interested in supporting the
> compact format, they can define new KEM code points for it.
> Would folks be comfortable proceeding on that basis?
>   Yes, I think this is an acceptable way forward. I can get an I-D out RSN
> in the expectation that RGLC finishes and we will soon have an HPKE RFC to
> update.
>   regards,
>   Dan.
> --Richard
> On Mon, Feb 15, 2021 at 11:45 AM Karthik Bhargavan <
>> wrote:
>> I think the idea of having a compact representation of EC points for use
>> in IoT-like scenarios is an attractive one, but the core ciphersuites of
>> HPKE should only depend on standardized and widely-implemented point
>> formats.
>> In particular, HPKE is certainly not the right place to standardize a new
>> EC point format, however sensible the change may seem.
>> A protocol like EDHOC is laser-focused on small wire messages and is
>> meant to be implemented by IoT-specific crypto libraries, and so it makes
>> sense for that protocol to employ such optimizations.
>> Perhaps the LAKE working group could drive a IETF/CFRG standard for
>> x-only EC point representations that are more generally usable by other
>> protocols?
>> Having said all that, HPKE is extensible and we do anticipate extensions
>> to HPKE in the near future, notably for adding PQ ciphersuites.
>> I think the best way to proceed for compact HPKE would be, along the
>> lines of Dan’s suggestion, to propose new KEM algorithm identifiers for
>> compact encodings of the NIST curves, and to do this as part of a new CFRG
>> draft as an extension to HPKE.
>> I suspect that, beyond the point representation, we may find other parts
>> of HPKE that would benefit from compaction for low-bandwidth scenarios.
>> Best,
>> Karthik
>> _______________________________________________
>> CFRG mailing list
> --
> "The object of life is not to be on the side of the majority, but to
> escape finding oneself in the ranks of the insane." -- Marcus Aurelius
> _______________________________________________
> CFRG mailing list