Re: [Cfrg] [Ntp] Last minute annoying discovery about NTS

[Dan Brown <[e-mail]>]

What's the added value of key-dependency in E_K1(E_K2(K1)) over, say,
Hash(K1+K2), or E_K1(1)+E_K2(2), or some other kind of key confirmation,
etc.?  

Also, should there be messages, as in E_K1(M1+E_K2(K1+M2)) to limit the
scope of replay attack to a particular message? 

For weak enough E, the value E_K1(E_K2(K1)) seems weak.  For example, if
e.g. E_K(M) = K xor M, then E_K1(E_K2(K1))=K2, which is probably bad if K2
is necessary for any other purpose, etc.  If there is no E_K2 oracle for the
adversary, then very weak E meets Shannon's theorem about one-time pads, so
E_K2(K1) and E_K2(R) are indistinguishable. So, any security proof (of what
goal?) would need more than this indistinguishability, either some extra
property E (not held by E_K(M) = K xor M).

> -----Original Message-----
> From: Cfrg <[e-mail]> On Behalf Of Daniel Franke
> Subject: Re: [Cfrg] [Ntp] Last minute annoying discovery about NTS
> 
> I think I might nonetheless spend my flight to Prague formalizing a
security
> proof, mostly as an exercise to improve my proficiency working in the
standard
> model. My intuition here is mostly that, even if the adversary is given
K1, it still
> can't distinguish E_{K2}(K1) from E{K2}(R) for random R; there therefore
> shouldn't be anything "special" about using E_{K2}(K1) as an input to
E_{K1}(.).
> A colleague has sketched out a plausible hybrid argument which sort of
> matches this intuition. I'm going to take that argument and see if I can
run with
> it.
> 
> On Wed, Mar 20, 2019 at 8:46 PM Watson Ladd <[e-mail]>
> wrote:
> >
> > I've managed to convince myself Daniel is right and there is no problem.
> >