[CFRG] Domain separation in HPKE
Martin Thomson <mt@lowentropy.net> Tue, 02 March 2021 03:41 UTC
Return-Path: <mt@lowentropy.net>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 722363A0FC0 for <cfrg@ietfa.amsl.com>; Mon, 1 Mar 2021 19:41:51 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.1
X-Spam-Level:
X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=RJ0zHLjN; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=FMHQd36z
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4wYEMqqfsTzy for <cfrg@ietfa.amsl.com>; Mon, 1 Mar 2021 19:41:50 -0800 (PST)
Received: from wout5-smtp.messagingengine.com (wout5-smtp.messagingengine.com [64.147.123.21]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05DA33A0FBF for <cfrg@irtf.org>; Mon, 1 Mar 2021 19:41:50 -0800 (PST)
Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id A1F057BE for <cfrg@irtf.org>; Mon, 1 Mar 2021 22:41:48 -0500 (EST)
Received: from imap10 ([10.202.2.60]) by compute1.internal (MEProxy); Mon, 01 Mar 2021 22:41:48 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:date:from:to:subject:content-type; s= fm1; bh=xb7DZhkKEEAeM+tcRXQxF2/7jTZH9YyJ2UBTkA2Rz6s=; b=RJ0zHLjN bMh6CtqeWPVaduV5xl2Zu0PHetLTBtc8Ltb1rorKWOav0J4A0F1FMmARJYSZb2sx O5G8KpGrrYs0IlZXnfqIylNgupor17TgwDbiHc4omMGn4nXlMA7TjjmjaZ19SyiB tvTWjGZi51kuDzRZNpCOr3IhwV5D/ElPGzhqVqo3ObD37WmDPmG23K/48Po5jsxL dkdRhV94Y7KZKo4qdOdbJ0mquFtpojktjjJJlRkvbC7ZeWJtg97w7ZsTLeSkLojw 7orrUH9mCzzjvTuiozeXginf27VEs9XugEKvWV/55p5p3Jjd7xlyy8YPqwLkjyx9 fYXjc6r6NJZUmg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm2; bh=xb7DZhkKEEAeM+tcRXQxF2/7jTZH9 YyJ2UBTkA2Rz6s=; b=FMHQd36zZVpgfVY25qaQzDkolWoyngyYDLBYikGlAmyuO cK4FKF/UtCBiNVPdZycUBDZo5yLSd2dnYroETwzOpz3vyrzd2dCLTTZe+ERRzKb5 srwHra01eOpUzdr0iOL77ZTZrZhgwN885caNAWJ3rbGdp+59ykyfPeGI+cuEb8AR 6Y4IpXTa7iAhgec80btb+v1YLZPzT/3GHi0f1X6QnliQC/L6SrUOXSt/Fo0DvGVI VNOkwcW2D+XdNNmtxsi+ixRWxHJH+OAChmiCsd/Q+57YMDw71aYxMywJAav2hij3 0ZfDU5jPL07Ko5KXRkl1zYBEGqAfoyk/jPSuvjMvw==
X-ME-Sender: <xms:-7M9YGFebLboTCkYFczGgGIcKkrilwau0rdJPT0bBhyl6KiVigJQqg> <xme:-7M9YHVxUXCH_gy3aVvEd9HbE0s0_57jx8hKxLCJqFY-Ittf9Ogg1HMlG4LlUvgAp yF6v36JbjysMQK-hqI>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduledrleelgdeiudcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkfffhvffutgesthdtredtre ertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohifvghn thhrohhphidrnhgvtheqnecuggftrfgrthhtvghrnhepvefguddtgfejfeduueehkeehke duueegheefgeevkeekgeelveevffeuudffheehnecuvehluhhsthgvrhfuihiivgeptden ucfrrghrrghmpehmrghilhhfrhhomhepmhhtsehlohifvghnthhrohhphidrnhgvth
X-ME-Proxy: <xmx:-7M9YALF2ANR-IxH76hp0cqBZQ80QgMOod3yfXLPchLKKYWD0rMj8w> <xmx:-7M9YAEaBwO8P4viOY4Co7IwFOhcUNYNNJdQALIUYl3TbBTzCiRHTA> <xmx:-7M9YMW8kr4KSxdPtNJJIcIhTG_stNlAEJ07ojl6kf9pXu3etRfd5w> <xmx:_LM9YEjU60HLVppjSkJq-Xn1BW8mJ_VS5ZhCt2foJbbTIKBL2zsRow>
Received: by mailuser.nyi.internal (Postfix, from userid 501) id 8C2ED4E04EB; Mon, 1 Mar 2021 22:41:47 -0500 (EST)
X-Mailer: MessagingEngine.com Webmail Interface
User-Agent: Cyrus-JMAP/3.5.0-alpha0-206-g078a48fda5-fm-20210226.001-g078a48fd
Mime-Version: 1.0
Message-Id: <708df80a-bc73-4d91-af33-4bb3fd351808@www.fastmail.com>
Date: Tue, 02 Mar 2021 14:41:26 +1100
From: Martin Thomson <mt@lowentropy.net>
To: cfrg@irtf.org
Content-Type: text/plain
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/PhsZ5LeVal1CNCvOt3OqIYkgBhw>
Subject: [CFRG] Domain separation in HPKE
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Tue, 02 Mar 2021 03:41:51 -0000
HPKE uses string labels for domain separation. However, this only works because the labels it uses are carefully chosen so that no label is a prefix of any other. The draft might benefit from mentioning this constraint as it is not obvious. Also in the text on domain separation: One way to ensure this is by using an equal or similar prefixing scheme with an identifier different from "HPKE-v1". LabeledExpand includes a 2-byte value that encodes the output length before this label, so this advice is wrong for that.
- [CFRG] Domain separation in HPKE Martin Thomson
- Re: [CFRG] Domain separation in HPKE Benjamin Lipp