IETF Logo Mail Archive

Re: [CFRG] compact representation and HPKE

John Mattsson <john.mattsson@ericsson.com> Sat, 13 February 2021 13:59 UTC

Return-Path: <john.mattsson@ericsson.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 386323A1219 for <cfrg@ietfa.amsl.com>; Sat, 13 Feb 2021 05:59:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.351
X-Spam-Level:
X-Spam-Status: No, score=-2.351 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.25, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gf7fQCJGyPOs for <cfrg@ietfa.amsl.com>; Sat, 13 Feb 2021 05:59:02 -0800 (PST)
Received: from EUR05-VI1-obe.outbound.protection.outlook.com (mail-vi1eur05on2045.outbound.protection.outlook.com [40.107.21.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC11C3A1218 for <cfrg@irtf.org>; Sat, 13 Feb 2021 05:59:01 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Z8t5TRIhS3Y0d6OIrQltpELoq1pevBsKTZ/opJRXd5Aly1QJBQeWLNDXAZLoPoK37pLzte88pHV5YxpfRptFIyQ+NIYhWqJttRyT3pLfqOTwZlhonYDbmNknN99QybDXMRtYaoMf73E7xE0qXQGpfF91ImbSfkudtXbRYTqMYWxpRfxCDWl5BZd+hFKKis6u1SKox0r+82ajxpT11o/E3RMSH97Z5NuNrNrgHaPG2P2KK+eU0kT9MQq9hg3IRCMnk31c3IJG3BJWdDkv93cLwipYOO5+/J92NfpsujrzlnSvL7zWikHIxyfWwZaxyM4egssKJPMlvsNjqotyWx2psQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NgMGBKVvZhmD1CbGK4WuhbIxT3nuFA0WZf8WrT9PcUw=; b=VVVM/asZgstNFGJYGguD1lzPbxDg5jj1R3f2qPy5309KValV0BE3xa4gKeULGE0YNftwOUd4s8WWp80K/4pEi4SclZ70VZhF7tkFlmJxUa/ki2LzSKh4cW6Zz+0Jv7UwQ90pbR3Hpdw8G76Rq4QAkjNRIasVwDwOJ2G9gTcbZlK+eVYPCsIzNX1zCFm9aOG5VhXa0yZzivG9hg9iKMADcURCXVmtj99pUIT/xqY3zeHsM7SRruDhus1I8ZyUHpdDXDNioc4Z/+wbGNrSHtYQn6PWhhtha6CVrDP/LGKqWtmvnmo1fbc2Wj876LRQkTuGkzH08ep/UnwId/GrCFiIrw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NgMGBKVvZhmD1CbGK4WuhbIxT3nuFA0WZf8WrT9PcUw=; b=VbCG2SS1/V7Gq8a3krZex+kapGKQwZV/3mn4Y8hMKrQpVYj3G4lB5QUPK0dCwVEct/N1lSQkiUNetBdbrAeJRgB2hXBKbf5F4jLfUFxL12VMy8Z0eZ9YzZSGe/CMoL2cNgw9fG8SrsIAwSYC+WnhPDDTT5nmTxSzKIqUNgLi+vU=
Received: from HE1PR0701MB3050.eurprd07.prod.outlook.com (2603:10a6:3:4b::8) by HE1PR0701MB2729.eurprd07.prod.outlook.com (2603:10a6:3:93::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3868.12; Sat, 13 Feb 2021 13:58:56 +0000
Received: from HE1PR0701MB3050.eurprd07.prod.outlook.com ([fe80::c555:6e47:970c:1268]) by HE1PR0701MB3050.eurprd07.prod.outlook.com ([fe80::c555:6e47:970c:1268%11]) with mapi id 15.20.3868.015; Sat, 13 Feb 2021 13:58:56 +0000
From: John Mattsson <john.mattsson@ericsson.com>
To: Benjamin Lipp <benjamin.lipp@inria.fr>, "cfrg@irtf.org" <cfrg@irtf.org>
Thread-Topic: [CFRG] compact representation and HPKE
Thread-Index: AQHWtHd/qk8nkHIbjU6W/w1XmEnRGqpVngYAgAAN+ACAALRXAIAARc4A///+aYCAACQEgA==
Date: Sat, 13 Feb 2021 13:58:55 +0000
Message-ID: <87025730-8779-4962-B2C4-DA87698E007E@ericsson.com>
References: <0fcfb0ed-249b-7cd3-09ba-ed1c73122383@lounge.org> <CABcZeBMGJQ7sAKovy3japXVVLWRB8ydpsDzZxhijvFCtXptsZQ@mail.gmail.com> <b7bd5286-ccc1-c753-9d09-c647619581b5@lounge.org> <1613205954048.85155@cs.auckland.ac.nz> <0ECCDE4D-D3CE-4376-9B05-CD3110860350@ericsson.com> <6f1999be-4dfd-45bb-9673-451de1e1dfcc@inria.fr>
In-Reply-To: <6f1999be-4dfd-45bb-9673-451de1e1dfcc@inria.fr>
Accept-Language: en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/16.45.21011103
authentication-results: inria.fr; dkim=none (message not signed) header.d=none;inria.fr; dmarc=none action=none header.from=ericsson.com;
x-originating-ip: [81.225.97.222]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 26f82a3a-68c4-4637-759a-08d8d0278119
x-ms-traffictypediagnostic: HE1PR0701MB2729:
x-microsoft-antispam-prvs: <HE1PR0701MB27295AB201573C37FA6E459F898A9@HE1PR0701MB2729.eurprd07.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:7219;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: zRWKCiTg4OWGFkqx7PwlLz0Kgy6aOs0OR84IoaIQju150rWEWy3dX6DzU3qD+sqwMTLZ0NTIMee5xhU5BEPy0kocv0RS8q9Vmu+s6kUmDJ2emEKq/INPmLcsyuffarj6xjyLRGSyH9WLgGohjtFZdG8bJmcghDoP+oL4PIYAS9NljsHPXWyO0QtB2HELIuN6skgOOLl+mTNtfi8lK20O/tKKOIKCNX/d8iInUojAm0DNsJbvbCjcBiOPLiEKGT2cPFs6KiVbcQBNPCZHDz5jrxr8i0p+FZqlT7lN+vnkLrNLXU3R+lCAG4obSATz8fU0pn22I85w58nxbMNj97oHs5WaRamvbp9ANwsuWBWMKk5TV8IlLc1DlXwIUWyq24YZIJ8I4IbdFx+EDP5q8RsP0skheQmU2HBpH33Ys9WQQPViVBLzYmQEfE8WP0+7RHtKU777Am16QBS5wTx2EZpRfOb5eHHCb3Z/ITT+F2qj2pbJccEB+4BrIna8TJ1TcvfSLn8w398IAgHiuO56hfIneSsyXo6Qg7IjHLo+U9VCY6xwUf0b/8Gj1MNmFfaNYZ/D5LAvjl+lFjG6QDqiMF1DHT+VOtbEThbniCY5mHpk5GY7XYTpxVE4Gdd2E7u3eOTUzMlMnGubMpLkA/euZUqHvSPVO+5TaIj1VPdo1JN6fME=
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR0701MB3050.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(39860400002)(346002)(366004)(136003)(376002)(33656002)(36756003)(2616005)(478600001)(8676002)(966005)(71200400001)(86362001)(110136005)(26005)(316002)(5660300002)(6486002)(8936002)(6512007)(83380400001)(66446008)(6506007)(76116006)(186003)(2906002)(44832011)(66556008)(66476007)(64756008)(66946007)(53546011)(45980500001); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: fHScTKLkL3cof1mLEFaoOaB1mL8hhzQoCyx9cHTXxO9GKOEfwQCBqzjEYqaSnN6XZas784hKTwl8cbNfowT4fWZcZETXPHDub54HJ0Ksn/PzbLUkuPjVobIs9A69jstB4k4mBPXknG0L68eXRTq0CpRr8Q9C0SOAaF64YPpLi/Ivr7mO7rsLOuvNECZdqqZAJc6dfgkXSYja4i10AHYjQLwUqZIrwBQMJEEKuGsRPMXz+a23xjzXR17FQaRlhUfSRK2FUe0RlzZ0dorYwTc9cGWswJBpCZxmZ+pCcmUQGg9jmQAobZfMvJD55t5l2FXUD+k2FDGg3Pht1f1Qw6U5uwd5YKZbdqvAS8GMObJaeqZWwyKtsWZ8F/r+PX2uFUsydbEVelVraEuP9+/EX4doUuGvQBuQ6wZJLCVRp1MmRD+gRN4Rc1q6j+SD0zFF7Bf7aAP9gTHanrNPBp/2w1paVw5I/6OBytdZTyfG10gV80AUzNG2nq2o7W/v4mDW+r8WeMS9bPIcxSy/qJdZdsLG9fpLHuesz//Ri/PT+e2e57A5viqCC7YiDLGe68ehFs1GpZzcqe/V6vaNnHMzSxCjFTp5ZFCX8TLNDeG9J1U0nhT6rLb9S8CgQb4umia2zW3vAWhCbx46BaOXNji1mvbKrZwqmzIdWVt6+JiJ2/U3Izpt8dE5SYTxevAxEZqUM05MaSPmT/K2yFqXe0E+fMSuTDM+CvaEQsV9KYdule6EXtE3pfDb7dTx2+GNI1vWDJwrGzKxsrcF4fY4FyKm1hm4IQMx7FnAaK3e3TsjWEMRFqC+3zU5uUCl60y59f4rqld+AL3JWxcdaytfkiGWSvW/hM9GAj2RwiV3PlgKlR00dz6Cn2eGQfOhJmtG3PtNxRpSnRy/tnTcZdopQMAc3EXrosG4KhBM2N0o14uaSZZjMjflAKv3hGrB8VbUG3OPOsWG41dYOepIYyCp+AMZqywWwhuYQOvEnE1qGgJKJ1pgte2/LikTqa9xv2JXMJHla9ZqljNkQKroJOber5s5zOei9kNvQ4gf64Qy4YyBylgwJVS8IYIlUkUWXUvxApMa8E4fizHG9b8K1v4gNNOZZCmOwuGXddBn4QwkG/fUHKsUYknRZgJE4Qzu7STEe3paC2PmCM6RB7kODTmGnVaSLPLRwgnEVDA79gjFtFi/t/1z2tdenf3LsN+GI4fgiwUfGRISO24QpVJRpN/8l/W18BY2lkwwuOx7i6HmyWzKqtD4x9K2OGrtAaiWmyQNY2TPL6UPNIWjIgB+BF9VHjLSdlGJe4QSS52+bauJBsoGbqg8A+xsqrTM7VNsFCgCIUMDidgr
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="utf-8"
Content-ID: <7E04926974718048889866EC78AD8394@eurprd07.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: ericsson.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: HE1PR0701MB3050.eurprd07.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 26f82a3a-68c4-4637-759a-08d8d0278119
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Feb 2021 13:58:56.0366 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: WCm4xY+6Ld6hw11NNjngO7P9hVeSM0ZQExX10AszIAg+9F0S86WiKiRPTBtNCs6ahckQpSRQRWtf+2irWc5f+CPDiAXW6DMPSfLi/OEhh7E=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2729
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/KIPJoFkJclc2Jk9L8yCh7-Ve6ZQ>
Subject: Re: [CFRG] compact representation and HPKE
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Sat, 13 Feb 2021 13:59:04 -0000

Thanks Benjamin,

I know it does. I did not intend to indicate that HPKE suffers from this, I just wanted to point out that this solution in ECIES systems is strange, and that the straightforward solution is to remove the malleable information that is not used anyway.

A long time ago, I think I promised on the CFRG list to suggest text stating that HPKE does not suffer from what SECG calls benign malleability. I just made a PR for this.

https://github.com/cfrg/draft-irtf-cfrg-hpke/pull/205


-----Original Message-----
From: CFRG <cfrg-bounces@irtf.org> on behalf of Benjamin Lipp <benjamin.lipp@inria.fr>
Date: Saturday, 13 February 2021 at 13:50
To: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [CFRG] compact representation and HPKE

Hi,

13 Feb 2021 12:56:25 John Mattsson <john.mattsson=40ericsson.com@dmarc.ietf.org>:

> Note that sending a useless y-coordiate on the wire is the reason why integrity protection of pKE is needed to provide IND-CCA2 for the NIST P-curves. This is one of the bad ideas from previous ECIES standards that I hoped (and still hope) HPKE will get rid off.

HPKE's DHKEM includes pkE and pkR (and pkS) in the context of the key derivation:

kem_context = concat(enc, pkRm)
shared_secret = ExtractAndExpand(dh, kem_context)

(enc is the serialization of pkE)

Does this mitigate the attack on IND-CCA2 that you have in mind?

Best,
Benjamin

_______________________________________________
CFRG mailing list
CFRG@irtf.org
https://protect2.fireeye.com/v1/url?k=17732f8f-48e8176d-17736f14-86073b36ea28-d0074ee430b256b3&q=1&e=596d9075-1e9d-4038-9335-766b5aa8ecb2&u=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg

v2.46.0 | Report a Bug | By Email | System Status