Re: [CFRG] [EXTERNAL] Re: How will Kyber be added to HPKE (9180)?

[Ilari Liusvaara <[e-mail]>]

On Thu, Nov 24, 2022 at 03:58:31PM +0000, Mike Ounsworth wrote:
> Thanks Ilari,
> 
> So to make sure I understood you correctly, the Kyber update to HPKE
> will only provide Encap() and Decap(), and WILL NOT provide
> AuthEncap() and AuthDecap() ?

Correct.


> In CMP both client and server have KEM certificates and we need client
> -> server messages to be authenticated by the client certificate. IE
> we were hoping to use HPKE mode_auth as a Kyber replacement for
> DHBasedMac defined in RFC4210 section 5.1.3.2 (authors are still
> discussing, but I think we would just use HPKE to get exporter keys
> to use with a MAC cause we don't need enveloping encryption, but don't
> quote me on that yet).
> 
> So if HPKE won't support mode_auth with Kyber, then there's no
> advantage to us adopting HPKE, and we should just define a
> KyberBasedMac mechanism directly based on [Kyber2018] fig 3?

There is no known way to do that (it is equivalent to non-interactive
authenticated key exchange). And that is the reason as why Kyber
will not support AuthEncap/AuthDecap.

As some others have noted, Kyber2018 fig 3 is interactive authenticated
key exchange. And there is no known way to make non-interactive
authenticated key exchange out of interactive authenticated key
exchange.



-Ilari