[Cfrg] Fwd: New Version Notification for draft-barnes-cfrg-hpke-00.txt

Raphael Robert <raphael@wire.com> Mon, 28 January 2019 15:17 UTC

Return-Path: <raphael@wire.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82E8F129A87 for <cfrg@ietfa.amsl.com>; Mon, 28 Jan 2019 07:17:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.041
X-Spam-Level:
X-Spam-Status: No, score=-2.041 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.142, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wire-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CqGw3wC4WfPk for <cfrg@ietfa.amsl.com>; Mon, 28 Jan 2019 07:17:39 -0800 (PST)
Received: from mail-ed1-x530.google.com (mail-ed1-x530.google.com [IPv6:2a00:1450:4864:20::530]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D72CF127598 for <cfrg@irtf.org>; Mon, 28 Jan 2019 07:17:38 -0800 (PST)
Received: by mail-ed1-x530.google.com with SMTP id h15so13298655edb.4 for <cfrg@irtf.org>; Mon, 28 Jan 2019 07:17:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wire-com.20150623.gappssmtp.com; s=20150623; h=from:mime-version:subject:message-id:date:to; bh=xrsdNfsNtoNJaG0t+uA38k+fWvxQ8XFEU4MNRZYu0nA=; b=c3YTxRnr6jyvaPOiFGOY28lYld2412GcS4rVrJGpd4+J3Qkf2PNanKJZn4N2JI+ZJX qb5ipSJj/RXQSUpqauhMEG2XhvMdkaGtuxx/8Dj7eZb1loSfaf5zYk/3QMx9nixEBdss GmiaNSymEsw7lbZ+PZMZgko235zyvpThbxa+lxshdIH7qTx/cUx6lohmqUPJFe2s610J sL5jwkLrxNZqlpDKHQ7Akq6zQoGxgyA29iCgQMhKJ33iIQL/pYFzHnlJFCW3dsbsF0CE cBm6u1IgCwVdZbVcka+BMqqm6YqSTi1NDcCFguChC5U8cHsTIfKo6T2WLN2HhfEyjHwY 0OvA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:message-id:date:to; bh=xrsdNfsNtoNJaG0t+uA38k+fWvxQ8XFEU4MNRZYu0nA=; b=iDn3CvH2bv4Jv+IF7bTRdieg+lC3LUxVyxmPTNgLZnlWiUD77t9hsAYhtTKB7E5lw+ w9qV8UbGTFCh2Ff2iZrJgwg/rQhALqqPvsZIzV8uTrLiKEFhVTVNceOPY0KzTQ5FFK6h 1WO1IP+e2hOFkI3mihZ0o+KGGqkkBjZiC7L4hPsPZQSasvMB9AmpRbvdbBUBqEkB0UKX 1DAy4R8uCHyfd3btDu5KA7ydq3ttnlBmrC/Dk/bouGYnRj+DGdNvm0VaILKgJAqISRJe 2A1sQYOANmoeHv9JM2r2iQCM1HZAmUPwTEj4Xkb6gelcn0+oP7wTwSvWARhLgrej2Fwy iNLw==
X-Gm-Message-State: AJcUukdhN1jqRwQpwbmnbo5e4iti33uxjAF4iKFrI5XcHl9k0TDjCuTp 7O5P7L+/Z0v/HP/tD2YBwZyfaH/V5d3H6A==
X-Google-Smtp-Source: ALg8bN7ZsyxWJdkG+HabiLTP8tf1IXnEirGrHto7IY4CBvyEy8Rrr9VxACSzNEMt54R63ocKP36wIg==
X-Received: by 2002:a05:6402:144c:: with SMTP id d12mr22662147edx.83.1548688656579; Mon, 28 Jan 2019 07:17:36 -0800 (PST)
Received: from rmbp.wire.local (h-62.96.148.44.host.de.colt.net. [62.96.148.44]) by smtp.gmail.com with ESMTPSA id gy12-v6sm7891181ejb.44.2019.01.28.07.17.34 for <cfrg@irtf.org> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 28 Jan 2019 07:17:35 -0800 (PST)
From: Raphael Robert <raphael@wire.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_E419957E-EE50-4444-ADBF-3795DF6CF4CD"
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
Message-Id: <4989B595-D57C-4D40-8B68-AB0AF8804AD3@wire.com>
Date: Mon, 28 Jan 2019 16:17:33 +0100
To: cfrg@irtf.org
X-Mailer: Apple Mail (2.3445.102.3)
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/iw3QT8e_m2M91-7-eW6YIHJNhtk>
Subject: [Cfrg] Fwd: New Version Notification for draft-barnes-cfrg-hpke-00.txt
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Jan 2019 15:17:42 -0000

Hey Richard,

The proposal seems rather generic to me and I like the channel binding to the responder's public key.

A few comments:

 - There seems to be some terminology mismatch between (receiver, responder and recipient) also possibly between (initiator and sender).
 - I suppose the ciphersuites are inspired by TLS. I'd like to raise the question if blake2 wouldn't make sense for the non-NIST ones.
 - The points brought up in Appendix A are important. In particular, I think it would be worthwhile investigating if a general KEM mechanism wouldn't be the better choice, potentially paving the way for PQ primitives.

Thanks

Raphael

> Hi CFRG folks,
> 
> I've just posted this draft that Karthik and I have been working on.  You
> may recall my having mentioned it at the IETF in Bangkok; it took us a bit
> longer than expected to get our ducks in a row :)
> 
> The idea here is to write a clean, easy-to-use spec for hybrid public-key
> encryption.  (We're using the name "ECIES", but as the draft notes, the
> idea is clearly more general.)  This primitive has come up in IETF work on
> MLS and ESNI [0][1], and in several other protocols, e.g., through the NaCl
> "box" API [2].  The hope here is to have a single spec that unifies these
> ideas and can be the target of formal verification.
> 
> I admit that there's a little bit of XKCD#927 here [3], but I think there's
> good work to do here in terms of addressing some more modern use cases
> (e.g., streaming / multiple encryptions from a single DH) and possibly
> enabling better post-quantum support by generalizing to KEM instead of DH.
> 
> This is obviously still at -00 quality, but we wanted to go ahead and ask
> whether this was a topic of interest to folks in CFRG.
> 
> Thanks,
> --Richard
> 
> [0]
> https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.md#direct-paths <https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.md#direct-paths>
> [1] https://tools.ietf.org/html/draft-ietf-tls-esni-02#section-5.1 <https://tools.ietf.org/html/draft-ietf-tls-esni-02#section-5.1>
> [2] https://nacl.cr.yp.to/box.html <https://nacl.cr.yp.to/box.html>
> [3] https://xkcd.com/927/ <https://xkcd.com/927/>
> 
> 
> ---------- Forwarded message ---------
> From: <internet-drafts@ietf.org> <mailto:internet-drafts@ietf.org&gt>;
> Date: Fri, Jan 18, 2019 at 6:08 PM
> Subject: New Version Notification for draft-barnes-cfrg-hpke-00.txt
> To: Richard L. Barnes <rlb@ipv.sx> <mailto:rlb@ipv.sx&gt>;, Karthikeyan Bhargavan <
> karthikeyan.bhargavan@inria.fr> <mailto:karthikeyan.bhargavan@inria.fr&gt>;
> 
> 
> 
> A new version of I-D, draft-barnes-cfrg-hpke-00.txt
> has been successfully submitted by Richard L. Barnes and posted to the
> IETF repository.
> 
> Name:           draft-barnes-cfrg-hpke
> Revision:       00
> Title:          Hybrid Public Key Encryption
> Document date:  2019-01-18
> Group:          Individual Submission
> Pages:          10
> URL:
> https://www.ietf.org/internet-drafts/draft-barnes-cfrg-hpke-00.txt <https://www.ietf.org/internet-drafts/draft-barnes-cfrg-hpke-00.txt>
> Status:         https://datatracker.ietf.org/doc/draft-barnes-cfrg-hpke/ <https://datatracker.ietf.org/doc/draft-barnes-cfrg-hpke/>
> Htmlized:       https://tools.ietf.org/html/draft-barnes-cfrg-hpke-00 <https://tools.ietf.org/html/draft-barnes-cfrg-hpke-00>
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-barnes-cfrg-hpke <https://datatracker.ietf.org/doc/html/draft-barnes-cfrg-hpke>
> 
> 
> Abstract:
>    This document describes a scheme for hybrid public-key encryption
>    (HPKE).  This scheme provides authenticated public key encryption of
>    arbitrary-sized plaintexts for a recipient public key.  HPKE works
>    for any Diffie-Hellman group and has a strong security proof.  We
>    provide instantiations of the scheme using standard and efficient
>    primitives.
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org <https://tools.ietf.org/>.
> 
> The IETF Secretariat