IETF Logo Mail Archive

Re: [CFRG] compact representation and HPKE

Benjamin Lipp <benjamin.lipp@inria.fr> Sat, 13 February 2021 12:50 UTC

Return-Path: <benjamin.lipp@inria.fr>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 090FA3A1146 for <cfrg@ietfa.amsl.com>; Sat, 13 Feb 2021 04:50:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.919
X-Spam-Level:
X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kpVTJ3LO7rwv for <cfrg@ietfa.amsl.com>; Sat, 13 Feb 2021 04:50:13 -0800 (PST)
Received: from mail3-relais-sop.national.inria.fr (mail3-relais-sop.national.inria.fr [192.134.164.104]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D62A3A1145 for <cfrg@irtf.org>; Sat, 13 Feb 2021 04:50:13 -0800 (PST)
X-IronPort-AV: E=Sophos;i="5.81,176,1610406000"; d="scan'208";a="372968842"
Received: from c80-217-0-47.bredband.comhem.se (HELO dummy.faircode.eu) ([80.217.0.47]) by mail3-relais-sop.national.inria.fr with ESMTP/TLS/AES256-GCM-SHA384; 13 Feb 2021 13:50:10 +0100
Date: Sat, 13 Feb 2021 12:50:01 +0000
From: Benjamin Lipp <benjamin.lipp@inria.fr>
To: cfrg@irtf.org
Message-ID: <6f1999be-4dfd-45bb-9673-451de1e1dfcc@inria.fr>
In-Reply-To: <0ECCDE4D-D3CE-4376-9B05-CD3110860350@ericsson.com>
References: <0fcfb0ed-249b-7cd3-09ba-ed1c73122383@lounge.org> <CABcZeBMGJQ7sAKovy3japXVVLWRB8ydpsDzZxhijvFCtXptsZQ@mail.gmail.com> <b7bd5286-ccc1-c753-9d09-c647619581b5@lounge.org> <1613205954048.85155@cs.auckland.ac.nz> <0ECCDE4D-D3CE-4376-9B05-CD3110860350@ericsson.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Correlation-ID: <6f1999be-4dfd-45bb-9673-451de1e1dfcc@inria.fr>
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/egpsjmEr3OoXTBLwXu9Q-g2a2lI>
Subject: Re: [CFRG] compact representation and HPKE
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Sat, 13 Feb 2021 12:50:15 -0000

Hi,

13 Feb 2021 12:56:25 John Mattsson <john.mattsson=40ericsson.com@dmarc.ietf.org>:

> Note that sending a useless y-coordiate on the wire is the reason why integrity protection of pKE is needed to provide IND-CCA2 for the NIST P-curves. This is one of the bad ideas from previous ECIES standards that I hoped (and still hope) HPKE will get rid off.

HPKE's DHKEM includes pkE and pkR (and pkS) in the context of the key derivation:

kem_context = concat(enc, pkRm)
shared_secret = ExtractAndExpand(dh, kem_context)

(enc is the serialization of pkE)

Does this mitigate the attack on IND-CCA2 that you have in mind?

Best,
Benjamin

v2.23.0 | Report a Bug | By Email