Re: [CFRG] Questions for the group from the HPKE presentation

[Martin Thomson <[e-mail]>]

On Mon, Aug 9, 2021, at 17:56, Richard Barnes wrote:
> W.r.t. (1), the obvious solution to me would be a reordering window 
> outside of the HPKE implementation.  

That doesn't work if there are gaps that never get filled.

I don't see a problem with defining something new (Windowed-HPKE, say) that allows for a) an explicit counter, b) more flexible anti-replay and c) tolerance of gaps.  This is what we do in DTLS relative to TLS, which has nearly identical properties at the record layer as this.

The authors/editors of HPKE are justifiably defending the ability of HPKE to progress.  Please, let it proceed to publication.  Let this work proceed independently.  (The technique isn't exactly novel, so it's not like this would be CFRG work either.  Take it to SECDISPATCH.)

Interestingly, none of that approach would depend on use of nonce-misuse resistant modes.