[CFRG] compact representation and HPKE

Dan Harkins <dharkins@lounge.org> Fri, 06 November 2020 20:00 UTC

Return-Path: <dharkins@lounge.org>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id 017623A0C4D for <cfrg@ietfa.amsl.com>; Fri, 6 Nov 2020 12:00:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id Q4ucz0PQcFOh for <cfrg@ietfa.amsl.com>; Fri, 6 Nov 2020 12:00:02 -0800 (PST)
Received: from www.goatley.com (www.goatley.com []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F87F3A0C4C for <cfrg@irtf.org>; Fri, 6 Nov 2020 12:00:02 -0800 (PST)
Received: from trixy.bergandi.net (cpe-76-176-14-122.san.res.rr.com []) by wwwlocal.goatley.com (PMDF V6.8 #2433) with ESMTP id <0QJE15XFD09095@wwwlocal.goatley.com> for cfrg@irtf.org; Fri, 06 Nov 2020 12:19:48 -0600 (CST)
Received: from blockhead.local ([]) by trixy.bergandi.net (PMDF V6.7-x01 #2433) with ESMTPSA id <0QJE00BCF07STB@trixy.bergandi.net> for cfrg@irtf.org; Fri, 06 Nov 2020 10:19:05 -0800 (PST)
Received: from 69-12-173-8.static.dsltransport.net ([] EXTERNAL) (EHLO blockhead.local) with TLS/SSL by trixy.bergandi.net ([]) (PreciseMail V3.3); Fri, 06 Nov 2020 10:19:05 -0800
Date: Fri, 06 Nov 2020 10:19:46 -0800
From: Dan Harkins <dharkins@lounge.org>
To: CFRG <cfrg@irtf.org>
Message-id: <0fcfb0ed-249b-7cd3-09ba-ed1c73122383@lounge.org>
MIME-version: 1.0
Content-type: text/plain; charset="utf-8"; format="flowed"
Content-language: en-US
Content-transfer-encoding: 8bit
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Thunderbird/68.12.0
X-PMAS-SPF: SPF check skipped for authenticated session (recv=trixy.bergandi.net, send-ip=
X-PMAS-External-Auth: 69-12-173-8.static.dsltransport.net [] (EHLO blockhead.local)
X-PMAS-Software: PreciseMail V3.3 [201104a] (trixy.bergandi.net)
X-PMAS-Allowed: system rule (rule allow header:X-PMAS-External noexists)
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/OvXG9sOaSaVjpGSk-B3HggC260Q>
Subject: [CFRG] compact representation and HPKE
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Nov 2020 20:00:04 -0000


   When doing a DH-based KEM with the NIST curves, HPKE specifies that
SerializePublicKey and DeserializePublicKey use the uncompressed format
from SECG. This ends up using 2*Ndh+1 octets to represent the serial
form of the public key.

   Since compact output is being used in DH-based KEMs-- that is, the
secret result of DH() is the x-coordinate of the resulting EC point--
it would also be possible to use compact representation (per RFC 6090)
and have SerializePublicKey merely do integer-to-octet string
conversions of the x-coordinate. DeserializePublicKey would then
do octet string-to-integer conversion for the x-coordinate and use the
equation of the curve to choose the y-coordinate. The sign isn't
important because we're doing compact output.

   This would make the interface for the NIST curves and the Bernstein
curves be uniform-- Serialize would produce an octet string of Ndh
and Deserialize would consume an octet string of Ndh-- at the cost
of some CPU inside DeserializePublicKey.

   Please consider this suggestion.



"The object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." -- Marcus Aurelius