Re: [CFRG] RGLC on draft-irtf-cfrg-dnhpke-03

[Richard Barnes <[e-mail]>]

On Fri, Dec 8, 2023 at 9:28 AM Taylor R Campbell <[e-mail]>
wrote:

> I haven't followed the whole thread here and I have no comment on HPKE
> in lossy networks, but in general DAE supports this use case easily:
> You can put a message number for replay detection in the header
> (associated data), or even keep it secret in the payload.
>
> DAE just obviates the need for a _separate_ fixed-size nonce parameter
> in the cipher that requires your message number to be shoehorned into
> a particular format, and serves to mitigate the damage if the sender's
> counter is reset to zero, e.g. in a VM rollback or a backup restore.
>

Conveniently, HPKE also obviates this need.  The nonce is computed as
(base_nonce XOR seq), and the base_nonce is known to both parties, so you
only need to communicate the sequence number.  Or, as Thomson points out,
enough bits of the sequence number to account for your loss/reordering
tolerances.

As for mitigating damage in the event of sender state loss: AES-GCM-SIV
also meets this brief, without the need for fundamental changes in the HPKE
security model.

--Richard