[Cfrg] IETF's secure messaging v public-key encryption

[Dan Brown <[e-mail]>]

Dear CFRG list:

Some IETF protocols, including CMS (and perhaps JOSE), offer schemes that are essentially public-key encryption: they protect a conveyed message from an unauthenticated (cryptographically anonymous) sender (**) to a recipient with a public key, with the wrinkle that they also permit multiple recipients (sharing a common "wrapped" key).

Although the sender has no authenticated key, the sender still applies a MAC to the message.  This application of a MAC has been called "authenticated" (with respect to whoever has the MAC key) in some places. It has also been called "integrity-protection" in other places.

Past versions of CMS message encryption did not apply the MAC. Consequently, the integrity of an encrypted message was not protected.

It seems that the purpose of the MACing corresponds closely to the cryptographers' notion of "non-malleability" (NM) goal public-key encryption schemes.  (If I recall correctly, NM-CCA2 has been proven equivalent to IND-CCA2.)

Questions:

1) Do the existing and proposed IETF public-key message encryption methods meet the cryptographer's benchmark of IND-CCA2 security? How important is that to meet these goals?  Can (or have) these cryptographer's security goals be proven for the specific CMS methods?

2) What is the best terminology to use in IETF?  How important is terminology?  Should the existing IETF terminology be amended?

3) What is the right formal definition when multiple recipients are involved?

I seek your answers, but here are my tentative answers:

1) The current proposals provide IND-CCA2.  It would be very hard to prove this (*).  It is important to provide at least IND-CCA1 security, but CCA2 is never really necessary.

2) "Non-malleability" is the best terminology for many general users, at least from my experience. Standard terminology is important, for mutual understanding, and accident avoidance.  The term "authenticated" should either removed when the sender does not use an authenticated key, or else change the term to "recipient-authenticated" (compare TLS and server authentication versus client authentication...).

3) The security definitions should be nearly the same for multiple recipients (which share a common symmetric key).

(*) Shoup [ISO 18033-2] introduced the KEM-DEM approach to hybrid PKE schemes, which may be highly useful for describing, and proving things about, the CMS methods.  I vaguely recall some research done in this area.

(**) In a separate message, I will discuss schemes in which the sender can also be authenticated by means of an authenticated key (but does not sign).

Best regards,

Daniel Brown

Research In Motion Limited




[cid:image001.gif@01CE31F0.30D41300]




---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.