Re: [CFRG] I-D Action: draft-irtf-cfrg-hpke-10.txt

[Benjamin Lipp <[e-mail]>]

Hello,

I don't think the addition of Section 9.4 closes the door for the draft
on DNHPKE.


The following sentence on IND-CCA2 security of HPKE has been included in
the HPKE draft already before -10:

> The HPKE construction defined herein is secure against (adaptive)
> chosen ciphertext attacks (IND-CCA2 secure) under classical
> assumptions about the underlying primitives […]

https://www.ietf.org/archive/id/draft-irtf-cfrg-hpke-10.html

In my view, the newly added Section 9.4 merely makes it more explicit
what security property of the AEAD is necessary to actually achieve this
security guarantee. Also, IND-CCA2 for the AEAD has already been
mentioned as a hypothesis for the security analysis in Section 9.1
before -10.


The draft on DNHPKE contains the following paragraph:

> The security guarantee of the HPKE AEAD modes is IND-CCA2. This is achieved in part through the unique nonce requirement they all share. By removing the requirement for a unique nonce, the security guarantee of HPKE is changed for these new DAE cipher modes but the security of the existing AEAD modes is unchanged.

https://www.ietf.org/archive/id/draft-harkins-cfrg-dnhpke-00.html

Here, the DNHPKE draft changes the security guarantee for HPKE. If the
draft can do that, it should also be able to override the requirement
for AEADs used within HPKE?


Best regards,
Benjamin.


On 12/07/2021 18:39, Dan Harkins wrote:
> 
>   Hello,
> 
>   -10 includes a new section, 9.4, that says:
> 
>      "All AEADs MUST be IND-CCA2-secure, as is currently true for all AEADs
>       listed in Section 7.3"
> 
> I don't believe this was discussed on the list and I don't agree with it.
> Using the AEADs in section 7.3 will give you a construction that is
> IND-CCA2
> secure but I don't think that all uses of HPKE MUST be.
> 
>   I have a draft on adding support for deterministic authenticated
> encryption
> to HPKE and this subtle addition to -10 closes the door on that. Since
> we did
> not discuss this addition I'd like to start discussing it before this draft
> gets too far.
> 
>   regards,
> 
>   Dan.
> 
> On 7/7/21 8:54 AM, [e-mail] wrote:
>> A New Internet-Draft is available from the on-line Internet-Drafts
>> directories.
>> This draft is a work item of the Crypto Forum RG of the IRTF.
>>
>>          Title           : Hybrid Public Key Encryption
>>          Authors         : Richard L. Barnes
>>                            Karthik Bhargavan
>>                            Benjamin Lipp
>>                            Christopher A. Wood
>>     Filename        : draft-irtf-cfrg-hpke-10.txt
>>     Pages           : 104
>>     Date            : 2021-07-07
>>
>> Abstract:
>>     This document describes a scheme for hybrid public-key encryption
>>     (HPKE).  This scheme provides a variant of public-key encryption of
>>     arbitrary-sized plaintexts for a recipient public key.  It also
>>     includes three authenticated variants, including one which
>>     authenticates possession of a pre-shared key, and two optional ones
>>     which authenticate possession of a KEM private key.  HPKE works for
>>     any combination of an asymmetric key encapsulation mechanism (KEM),
>>     key derivation function (KDF), and authenticated encryption with
>>     additional data (AEAD) encryption function.  Some authenticated
>>     variants may not be supported by all KEMs.  We provide instantiations
>>     of the scheme using widely used and efficient primitives, such as
>>     Elliptic Curve Diffie-Hellman key agreement, HKDF, and SHA2.
>>
>>     This document is a product of the Crypto Forum Research Group (CFRG)
>>     in the IRTF.
>>
>>
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-irtf-cfrg-hpke/
>>
>> There is also an HTML version available at:
>> https://www.ietf.org/archive/id/draft-irtf-cfrg-hpke-10.html
>>
>> A diff from the previous version is available at:
>> https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-hpke-10
>>
>>
>> Internet-Drafts are also available by anonymous FTP at:
>> ftp://ftp.ietf.org/internet-drafts/
>>
>>
>> _______________________________________________
>> CFRG mailing list
>> [e-mail]
>> https://www.irtf.org/mailman/listinfo/cfrg
>