[CFRG] misuse-resistant AEAD and HPKE

[Dan Harkins <[e-mail]>]

   Hello,

   For some use cases it would be good to avoid the stateful requirements
of the the Seal() and Open() constructs in HPKE. This would seem especially
important if (skX, pkX) are derived deterministically which could result
in reuse of a particular nonce-secret for distinct invocations of Seal()
or Open().

   Rogaway and Shrimpton formalized the notion of a misuse-resistant AEAD
scheme in [1]. The mode they defined, AES-SIV, has the following properties:

    - the nonce can be arbitrary;
    - the nonce can repeat without loss of authenticity of the message,
      with privacy lost to the extent that one could know that the same
      message was sent (if, in fact, it was);
    - the nonce is not even required-- truly deterministic AEAD.

While that last property is pretty cool, it would probably be too
hard to pry into HPKE at this point. But the other properties could
be supported quite straightforwardly I think.

   AES-SIV has been defined in RFC 5297. I would be happy to provide
some suggested text to add support for AES-SIV if there is consensus
that it's a good idea.

   regards,

   Dan.

[1] "Deterministic Authenticated Encryption, A Provable-Security Treatment
     of the Key-Wrap Problem"-- EUROCRYPT '06, St. Petersburg, Russia, 2006.


-- 
"The object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." -- Marcus Aurelius