Re: [CFRG] HPKE and Key Wrapping

[John Mattsson <[e-mail]>]

Martin and Ilari wrote:

>> HPKE has a PSK input too.  Are you forgetting that option?  Given
>> the setting, that is the more relevant mode to consider.
>
>Wouldn't that still result in key/nonce collision, which breaks any
>current cipher HPKE can use, in case random bits get reused with the
>same PSK and recipient key?

I don’t know why a PSK would be relevant? My use case would be to use a public key to encrypt another key, in this case using ECIES/HPKE.

>However, I expect that virtually invariably if random bits get reused,
>those random bits are very weak anyway. Which would let attacker decrypt
>the message anyway (unless PSK is also used).

That is a good point. The current HPKE will always be reliant on random bits. Using HPKE in way that is not dependant on random bits would require to make skX an input to the algorithm. I.e. doing Static-Static Diffie-Hellman (NIKE) instead of Ephemeral-Static, but where the recipient would not need to have pkX beforehand.


From: CFRG <[e-mail]> on behalf of Ilari Liusvaara <[e-mail]>
Date: Thursday, 31 March 2022 at 12:42
To: [e-mail] <[e-mail]>
Subject: Re: [CFRG] HPKE and Key Wrapping
On Thu, Mar 31, 2022 at 09:23:14AM +1100, Martin Thomson wrote:
> On Thu, Mar 31, 2022, at 04:53, John Mattsson wrote:
> > - The input to single-shot HPKE used for key wrap would be
> >
> > ct = HPKE-single-shot-encrypt(pkR, random bits, aad, pt)
> > pt = HPKE-single-shot-decrypt(skR, aad, ct)
> >
> > where “random bits” are used in GenerateKeyPair().
>
> I agree that this would not be secure if the attacker was even able
> to cause the same randomness to be used twice.
>
> HPKE has a PSK input too.  Are you forgetting that option?  Given
> the setting, that is the more relevant mode to consider.

Wouldn't that still result in key/nonce collision, which breaks any
current cipher HPKE can use, in case random bits get reused with the
same PSK and recipient key?

However, I expect that virtually invariably if random bits get reused,
those random bits are very weak anyway. Which would let attacker decrypt
the message anyway (unless PSK is also used).



-Ilari

_______________________________________________
CFRG mailing list
[e-mail]
https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-40f7d10cf9eb7c69&q=1&e=971901ec-a598-4ea4-afd9-3b94ad573de0&u=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg