Re: [CFRG] HPKE and Key Wrapping

[Ilari Liusvaara <[e-mail]>]

On Thu, Mar 31, 2022 at 11:23:19AM +0000, John Mattsson wrote:
> Martin and Ilari wrote:
> 
> >> HPKE has a PSK input too.  Are you forgetting that option?  Given
> >> the setting, that is the more relevant mode to consider.
> >
> >Wouldn't that still result in key/nonce collision, which breaks any
> >current cipher HPKE can use, in case random bits get reused with the
> >same PSK and recipient key?
> 
> I don’t know why a PSK would be relevant? My use case would be to
> use a public key to encrypt another key, in this case using
> ECIES/HPKE.

Oh, and then there are auth and authpsk modes too...

IIRC, the inputs that affect the symmetric encryption key and nonce
are:

- Randomness
- Recipient public key
- PSK (if present)
- Authentication key (if present)

If all these collide, then symmetric keys collide, and that makes all
the ciphers currently in HPKE break.

Fixing this would require adding a new MRAE cipher.

> >However, I expect that virtually invariably if random bits get reused,
> >those random bits are very weak anyway. Which would let attacker decrypt
> >the message anyway (unless PSK is also used).
> 
> That is a good point. The current HPKE will always be reliant on
> random bits. Using HPKE in way that is not dependant on random
> bits would require to make skX an input to the algorithm. I.e.
> doing Static-Static Diffie-Hellman (NIKE) instead of Ephemeral-Static,
> but where the recipient would not need to have pkX beforehand.

I think one would need MRAE cipher too, as otherwise the symmetric
encryption keys and nonces could get reused, which breaks current
ciphers.



-Ilari