Re: [CFRG] How will Kyber be added to HPKE (9180)?

[Ilari Liusvaara <[e-mail]>]

On Fri, Nov 25, 2022 at 05:47:19PM +0000, Mike Ounsworth wrote:
> Hey Panos,
> 
> Yes, CMP does those. Those cases are fairly straight-forward to port to KEMs.
> 
> Here we’re considering, for example, when a client (aka a certificate
> holder) sends a request to request, renew, or update the key in its
> certificate. Those requests are authenticated with the certificate in
> question.
> 
> rfc4210#section-5.1.3 describes three message integrity protection
> modes:
> 
> - PasswordBasedMac
> - DHBasedMac
> - Signature
> 
> I believe if you have an RSA key marked with keyUsage:keyEncipherment
> then you just cheat and sign with it anyway.
> 
> The answer seems to be that to do a KyberBasedMac, we need an extra
> round trip (possible separate HPKEs in each direction?). That would
> add an extra round-trip compared to the three message integrity
> mechanisms above, but since revocation / renewal are infrequent
> operations, probably that’s fine?

Maybe this is too naive, but...

Have CA send handle and encrypted MAC key. Then subscriber can send the
message together with the handle and MAC using the key sent by the CA.

A possible issue for using HPKE for the first message is that HPKE might
not have any KEM suitable for the key in certificate (e.g., key is
Kyber512, but HPKE does not have non-composite Kyber512 KEM).


With regards to number of round-trips, I do not think any even remotely
reasonable number of round-trips has any significant impact on latency,
especially given this is asynchronous operation.



-Ilari