Re: [CFRG] HPKE and Key Wrapping

[Ilari Liusvaara <[e-mail]>]

On Thu, Mar 31, 2022 at 09:23:14AM +1100, Martin Thomson wrote:
> On Thu, Mar 31, 2022, at 04:53, John Mattsson wrote:
> > - The input to single-shot HPKE used for key wrap would be
> > 
> > ct = HPKE-single-shot-encrypt(pkR, random bits, aad, pt) 
> > pt = HPKE-single-shot-decrypt(skR, aad, ct) 
> > 
> > where “random bits” are used in GenerateKeyPair(). 
> 
> I agree that this would not be secure if the attacker was even able
> to cause the same randomness to be used twice.
> 
> HPKE has a PSK input too.  Are you forgetting that option?  Given
> the setting, that is the more relevant mode to consider.

Wouldn't that still result in key/nonce collision, which breaks any
current cipher HPKE can use, in case random bits get reused with the
same PSK and recipient key?

However, I expect that virtually invariably if random bits get reused,
those random bits are very weak anyway. Which would let attacker decrypt
the message anyway (unless PSK is also used).



-Ilari