Re: [CFRG] HPKE and Key Wrapping

Jumping in late. 

> I think HPKE is the future of asymmetric encryption including asymmetric key wrapping.

+1 on what John M. said 

> So, it would be really nice to use a Key-Wrap algorithm in HPKE to encrypt the KEK.

+1 on what Russ suggested. 
Imo, HPKE is what should be used in CMS for asymmetric encryption as well. 

Just FYI, since wherever asymmetric encryption is discussed the PQ thread can be brought up, https://eprint.iacr.org/2022/414.pdf includes some work we did on adding PQ KEMs in HPKE. Nothing earth shattering. Just experimentation with PQ-only and PQ-hybrid HPKE to show that if the PQ KEM has OK performance, PQ HPKE is still fine. There are still gaps in terms of proofs which are not addressed in the paper.

-----Original Message-----
From: CFRG <cfrg-bounces@irtf.org> On Behalf Of Russ Housley
Sent: Wednesday, March 30, 2022 4:16 PM
To: Martin Thomson <mt@lowentropy.net>
Cc: IRTF CFRG <cfrg@irtf.org>
Subject: RE: [EXTERNAL] [CFRG] HPKE and Key Wrapping

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.

Martin:
>
> On Tue, Mar 29, 2022, at 20:05, John Mattsson wrote:
>> Would it make sense to standardize AES-KWP for HPKE or do CFRG 
>> believe that AES-SIV is the future of key wrapping? Irrespectively I 
>> think the CFRF should produce a good recommendation on how to use 
>> HPKE for key wrapping.
>
> What is wrong with the existing HPKE cipher suites for protecting keying materials?  That is, aside from not carrying a NIST approval stamp.

If you try to apply HPKE to the COSE or JOSE structures, it just does not quite fit.  However, by using HPKE to deliver a key-encryption key (KEK) to the recipient, the structures fit.  So, it would be really nice to use a Key-Wrap algorithm in HPKE to encrypt the KEK.

Russ
_______________________________________________
CFRG mailing list
CFRG@irtf.org
https://www.irtf.org/mailman/listinfo/cfrg