[Cfrg] Fwd: New Version Notification for draft-barnes-cfrg-hpke-00.txt
Raphael Robert <raphael@wire.com> Mon, 28 January 2019 15:17 UTC
Return-Path: <raphael@wire.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82E8F129A87 for <cfrg@ietfa.amsl.com>; Mon, 28 Jan 2019 07:17:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.041
X-Spam-Level:
X-Spam-Status: No, score=-2.041 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.142, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wire-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CqGw3wC4WfPk for <cfrg@ietfa.amsl.com>; Mon, 28 Jan 2019 07:17:39 -0800 (PST)
Received: from mail-ed1-x530.google.com (mail-ed1-x530.google.com [IPv6:2a00:1450:4864:20::530]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D72CF127598 for <cfrg@irtf.org>; Mon, 28 Jan 2019 07:17:38 -0800 (PST)
Received: by mail-ed1-x530.google.com with SMTP id h15so13298655edb.4 for <cfrg@irtf.org>; Mon, 28 Jan 2019 07:17:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wire-com.20150623.gappssmtp.com; s=20150623; h=from:mime-version:subject:message-id:date:to; bh=xrsdNfsNtoNJaG0t+uA38k+fWvxQ8XFEU4MNRZYu0nA=; b=c3YTxRnr6jyvaPOiFGOY28lYld2412GcS4rVrJGpd4+J3Qkf2PNanKJZn4N2JI+ZJX qb5ipSJj/RXQSUpqauhMEG2XhvMdkaGtuxx/8Dj7eZb1loSfaf5zYk/3QMx9nixEBdss GmiaNSymEsw7lbZ+PZMZgko235zyvpThbxa+lxshdIH7qTx/cUx6lohmqUPJFe2s610J sL5jwkLrxNZqlpDKHQ7Akq6zQoGxgyA29iCgQMhKJ33iIQL/pYFzHnlJFCW3dsbsF0CE cBm6u1IgCwVdZbVcka+BMqqm6YqSTi1NDcCFguChC5U8cHsTIfKo6T2WLN2HhfEyjHwY 0OvA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:message-id:date:to; bh=xrsdNfsNtoNJaG0t+uA38k+fWvxQ8XFEU4MNRZYu0nA=; b=iDn3CvH2bv4Jv+IF7bTRdieg+lC3LUxVyxmPTNgLZnlWiUD77t9hsAYhtTKB7E5lw+ w9qV8UbGTFCh2Ff2iZrJgwg/rQhALqqPvsZIzV8uTrLiKEFhVTVNceOPY0KzTQ5FFK6h 1WO1IP+e2hOFkI3mihZ0o+KGGqkkBjZiC7L4hPsPZQSasvMB9AmpRbvdbBUBqEkB0UKX 1DAy4R8uCHyfd3btDu5KA7ydq3ttnlBmrC/Dk/bouGYnRj+DGdNvm0VaILKgJAqISRJe 2A1sQYOANmoeHv9JM2r2iQCM1HZAmUPwTEj4Xkb6gelcn0+oP7wTwSvWARhLgrej2Fwy iNLw==
X-Gm-Message-State: AJcUukdhN1jqRwQpwbmnbo5e4iti33uxjAF4iKFrI5XcHl9k0TDjCuTp 7O5P7L+/Z0v/HP/tD2YBwZyfaH/V5d3H6A==
X-Google-Smtp-Source: ALg8bN7ZsyxWJdkG+HabiLTP8tf1IXnEirGrHto7IY4CBvyEy8Rrr9VxACSzNEMt54R63ocKP36wIg==
X-Received: by 2002:a05:6402:144c:: with SMTP id d12mr22662147edx.83.1548688656579; Mon, 28 Jan 2019 07:17:36 -0800 (PST)
Received: from rmbp.wire.local (h-62.96.148.44.host.de.colt.net. [62.96.148.44]) by smtp.gmail.com with ESMTPSA id gy12-v6sm7891181ejb.44.2019.01.28.07.17.34 for <cfrg@irtf.org> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 28 Jan 2019 07:17:35 -0800 (PST)
From: Raphael Robert <raphael@wire.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_E419957E-EE50-4444-ADBF-3795DF6CF4CD"
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
Message-Id: <4989B595-D57C-4D40-8B68-AB0AF8804AD3@wire.com>
Date: Mon, 28 Jan 2019 16:17:33 +0100
To: cfrg@irtf.org
X-Mailer: Apple Mail (2.3445.102.3)
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/iw3QT8e_m2M91-7-eW6YIHJNhtk>
Subject: [Cfrg] Fwd: New Version Notification for draft-barnes-cfrg-hpke-00.txt
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Jan 2019 15:17:42 -0000
Hey Richard, The proposal seems rather generic to me and I like the channel binding to the responder's public key. A few comments: - There seems to be some terminology mismatch between (receiver, responder and recipient) also possibly between (initiator and sender). - I suppose the ciphersuites are inspired by TLS. I'd like to raise the question if blake2 wouldn't make sense for the non-NIST ones. - The points brought up in Appendix A are important. In particular, I think it would be worthwhile investigating if a general KEM mechanism wouldn't be the better choice, potentially paving the way for PQ primitives. Thanks Raphael > Hi CFRG folks, > > I've just posted this draft that Karthik and I have been working on. You > may recall my having mentioned it at the IETF in Bangkok; it took us a bit > longer than expected to get our ducks in a row :) > > The idea here is to write a clean, easy-to-use spec for hybrid public-key > encryption. (We're using the name "ECIES", but as the draft notes, the > idea is clearly more general.) This primitive has come up in IETF work on > MLS and ESNI [0][1], and in several other protocols, e.g., through the NaCl > "box" API [2]. The hope here is to have a single spec that unifies these > ideas and can be the target of formal verification. > > I admit that there's a little bit of XKCD#927 here [3], but I think there's > good work to do here in terms of addressing some more modern use cases > (e.g., streaming / multiple encryptions from a single DH) and possibly > enabling better post-quantum support by generalizing to KEM instead of DH. > > This is obviously still at -00 quality, but we wanted to go ahead and ask > whether this was a topic of interest to folks in CFRG. > > Thanks, > --Richard > > [0] > https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.md#direct-paths <https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.md#direct-paths> > [1] https://tools.ietf.org/html/draft-ietf-tls-esni-02#section-5.1 <https://tools.ietf.org/html/draft-ietf-tls-esni-02#section-5.1> > [2] https://nacl.cr.yp.to/box.html <https://nacl.cr.yp.to/box.html> > [3] https://xkcd.com/927/ <https://xkcd.com/927/> > > > ---------- Forwarded message --------- > From: <internet-drafts@ietf.org> <mailto:internet-drafts@ietf.org>>; > Date: Fri, Jan 18, 2019 at 6:08 PM > Subject: New Version Notification for draft-barnes-cfrg-hpke-00.txt > To: Richard L. Barnes <rlb@ipv.sx> <mailto:rlb@ipv.sx>>;, Karthikeyan Bhargavan < > karthikeyan.bhargavan@inria.fr> <mailto:karthikeyan.bhargavan@inria.fr>>; > > > > A new version of I-D, draft-barnes-cfrg-hpke-00.txt > has been successfully submitted by Richard L. Barnes and posted to the > IETF repository. > > Name: draft-barnes-cfrg-hpke > Revision: 00 > Title: Hybrid Public Key Encryption > Document date: 2019-01-18 > Group: Individual Submission > Pages: 10 > URL: > https://www.ietf.org/internet-drafts/draft-barnes-cfrg-hpke-00.txt <https://www.ietf.org/internet-drafts/draft-barnes-cfrg-hpke-00.txt> > Status: https://datatracker.ietf.org/doc/draft-barnes-cfrg-hpke/ <https://datatracker.ietf.org/doc/draft-barnes-cfrg-hpke/> > Htmlized: https://tools.ietf.org/html/draft-barnes-cfrg-hpke-00 <https://tools.ietf.org/html/draft-barnes-cfrg-hpke-00> > Htmlized: https://datatracker.ietf.org/doc/html/draft-barnes-cfrg-hpke <https://datatracker.ietf.org/doc/html/draft-barnes-cfrg-hpke> > > > Abstract: > This document describes a scheme for hybrid public-key encryption > (HPKE). This scheme provides authenticated public key encryption of > arbitrary-sized plaintexts for a recipient public key. HPKE works > for any Diffie-Hellman group and has a strong security proof. We > provide instantiations of the scheme using standard and efficient > primitives. > > > > > Please note that it may take a couple of minutes from the time of submission > until the htmlized version and diff are available at tools.ietf.org <https://tools.ietf.org/>. > > The IETF Secretariat
- [Cfrg] Fwd: New Version Notification for draft-ba… Richard Barnes
- [Cfrg] Fwd: New Version Notification for draft-ba… Raphael Robert
- Re: [Cfrg] Fwd: New Version Notification for draf… Christopher Wood
- Re: [Cfrg] Fwd: New Version Notification for draf… Ilari Liusvaara
- Re: [Cfrg] Fwd: New Version Notification for draf… Christopher Wood
- Re: [Cfrg] Fwd: New Version Notification for draf… Richard Barnes
- Re: [Cfrg] Fwd: New Version Notification for draf… John Mattsson
- Re: [Cfrg] Fwd: New Version Notification for draf… Richard Barnes