Re: [CFRG] new draft modifying HPKE

[John Mattsson <[e-mail]>]

Hi Dan,

New KEMs with Compact Representation
------------------------------------

Thanks for spending time of this! I think this is great work. I don't have any comments on this part of your draft, it seems very well written. Some related stuff:

- After the HPKE discussions on compact representations there was a suggestion from Karthik that the LAKE WG could specify a compact representation format that could be usable by other protocols. This was done in an appendix of the EDHOC draft. I don't know if there is any need for alignment with your draft.
https://datatracker.ietf.org/doc/html/draft-ietf-lake-edhoc-12#appendix-B

- There is an ongoing discussion in the TLS WG regarding compact representation:
https://mailarchive.ietf.org/arch/browse/tls/?gbt=1&index=9f5CCCAksexcvJ5JuPsBOcvigpw

- There is a new draft in COSE suggesting using HPKE in COSE., which is aimed at constrained IoT.
https://datatracker.ietf.org/doc/draft-tschofenig-cose-hpke/
https://mailarchive.ietf.org/arch/msg/cose/KbuVtBk5vcxrTOzi2TWTUZiikmk/

Deterministic AEADs
------------------------------------

Having read the draft quickly once, I don't realize immediately when the use of nonces would be a big problem, but I am sure you will explain when you present this to CFRG.

"in the case proposed here, the nonce is not used"

I see nonce-resistant modes as an extra security measure that helps when nonce reuse happens for some reason. Not using a nonce by default leads as you say to "concealment of whether or not a given plaintext was encrypted twice". I don't think that is a good security level, unless you are sure than your plaintexts will be different. I think “no nonce” should only be recommended for applications where it is known that the plaintexts will be different.

Cheers,
John

From: CFRG <[e-mail]> on behalf of Dan Harkins <[e-mail]>
Date: Monday, 14 June 2021 at 20:08
To: [e-mail] <[e-mail]>
Subject: [CFRG] new draft modifying HPKE

   Hello,

   I know the cement on HPKE isn't quite dry yet but I wanted to get
something ready
for when it is. As I've discussed on this list before I want to add 2
things to HPKE:

   - compact output of the NIST curves
   - deterministic authenticated encryption

There's a new draft in the repository proposing just that:

     https://datatracker.ietf.org/doc/draft-harkins-cfrg-dnhpke/

Please take a look. Comments are welcome.

   Also, I implemented this in my HPKE code:
https://protect2.fireeye.com/v1/url?k=75e2b750-2a798e50-75e2f7cb-86fc6812c361-5e7ecf43d4ad5e61&q=1&e=abe1414d-b2b6-46d7-a3e2-201e6cb4b21f&u=https%3A%2F%2Fgithub.com%2Fdanharkins%2Fhpke-wrap.
The test vectors there are basically copied from the standard ones but I
replaced
the KEM with the new KEM, compacted serialization, and encrypted with
AES-SIV. I'd
welcome any attempts at interoperation.

   regards,

   Dan.

--
"The object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." -- Marcus Aurelius

_______________________________________________
CFRG mailing list
[e-mail]
https://protect2.fireeye.com/v1/url?k=fa797d66-a5e24466-fa793dfd-86fc6812c361-1938fbf5cdc3e03c&q=1&e=abe1414d-b2b6-46d7-a3e2-201e6cb4b21f&u=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg