Date: Thu, 6 Mar 2025 14:48:02 -0500
From: "Riad S. Wahby" <rsw@jfet.org>
To: cfrg@irtf.org
Message-ID: <ewavpsoh77jpkw3lnngmyq2w52rlnj6rjvbo32bwnmskzev2xv@kf2pf5kqia5f>
References: 
 <174104647991.518397.15722864021260778275@dt-datatracker-5dd67b77bb-4k4zh>
 <CAFR824wzxpHE6Vqb2zJqSCE6ZMN4JT8CTjW9Yj4wbkeki5idfQ@mail.gmail.com>
 <600a2260-e564-4540-af9f-9632fba7bced@posteo.de>
 <CAEEbLAaBx2gh1wTwsm_JwFX=bF9DyGQO7hPv=sFMpS=khmfLiA@mail.gmail.com>
 <CAEEbLAYYAGeF-tGVG3z3d9aCHgoWmHZ5bbM3seUFC4BQVPvovQ@mail.gmail.com>
 <9805e12b-f77a-44f8-9fe5-e15287b2008d@posteo.de>
 <Z8iM2zhhspgWIKOg@LK-Perkele-VII2.locald>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Z8iM2zhhspgWIKOg@LK-Perkele-VII2.locald>
Message-ID-Hash: ZCCZDWGI3RF7Z5VZ337QLE7IBRIVCDYT
Precedence: list
Subject: =?utf-8?q?=5BCFRG=5D_Re=3A_SHA-3_for_HPKE?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/cfrg/Eco4764dW7CoMZClp0zsSobMzts>

Ilari Liusvaara <ilariliusvaara@welho.com> wrote:
> Furthermore, that sounds like something that would cause major issues
> with existing implementations.

Agreed.

It seems like the reasonable options are either to use HKDF with SHA3
(which is perfectly fine; HMAC works just fine with sponges, even if it's
not necessary) or to first define an extract-and-expand abstraction that
is tailored to SHA3 (or, even better, tailored to sponges generally) and
then use that.

In the latter case, it would be best for the extract-and-expand construction
to be explicit and accompanied by a clear analysis (along the lines of what's
provided for HKDF). An ad-hoc construction that lacks this analysis probably
shouldn't be recommended for use. It would also be great if this analysis
weren't just "sponges look like random oracles, so this is OK". Because one
of the nice things about HKDF is that we are able to avoid jumping to the
strongest possible model of the hash function and still get a useful result.

All of this is to say: it's a heck of a lot less work to rely on HKDF.
So if the complaint is a few extraneous invocations of the hash function,
it seems to me like the work (of writing, reviewing, revising, etc.) isn't
so easy to justify.

That said, I would be happy to see such an analysis published, and would
certainly read it :)

Cheers,

-=rsw