Subject: Re: [Cfrg] Second RGLC on draft-irtf-cfrg-hpke

From: Christopher Patton <[email-masked]>
Date: Mon, 31 Aug 2020 10:26:11 -0700

I support publication. Below are some minor editorial things that might be
worth
addressing if there's time to do so.

Best,
Chris P.

Abstract

"for any combination of" -> "for several combinations of"

Section 4

"random(Nsk)" is used but "random()" isn't defined yet.

"not passed as parameter" -> "not passed as a parameter"

Section 5

"the holder of the private key corresponding to `pkR`" -> "the holder of
`skR`"

In various places, e.g., 'KeySchedule()' in Section 5.1, value "" is used
as the
salt for KDF extraction. I'm wondering if implementations might
misinterpret
this. I read "" as 'the empty string', but the correct interpretation might
be
'nil', i.e., 'None' in Python or 'NULL' in C. The HKDF spec defines the
salt as
follows: 'optional salt value (a non-secret random value); if not provided,
it
is set to a string of HashLen zeros.' I think the intention is to interpret
""
as 'nil', i.e., no salt, but the empty string is certainly a valid salt for
HKDF, since the extraction function is well-defined on this input. A
0-length
salt might not be safe choice in terms of security, however.

Section 5.2

I think the HPKE uses the term "nonce" incorrectly, since it's not a "Number
that's used ONCE". In fact, it's used every time the "Seal()" or "Open()"
operation is run. What's called a "nonce" here is usually called the
"initialization vector" elsewhere: in TLS 1.3 for example, the "nonce" is
the
initialization vector XORed with a sequence number.

On Mon, Aug 31, 2020 at 9:14 AM Joseph Salowey <[email-masked]> wrote:

>
>
> On Sun, Aug 16, 2020 at 1:51 AM Stanislav V. Smyshlyaev <[email-masked]>
> wrote:
>
>> Dear CFRG participants,
>>
>> This message starts a second 2-week RGLC on "Hybrid Public Key
>> Encryption" (draft-irtf-cfrg-hpke-05), that will end on August 31st. See
>> https://datatracker.ietf.org/doc/draft-irtf-cfrg-hpke/ for the latest
>> version of the draft.
>>
>> We are having the second RGLC because we didn't have much feedback
>> during the first RGLC and because we have obtained two new Crypto Panel
>> reviews:
>>
>> https://mailarchive.ietf.org/arch/msg/crypto-panel/Ol1Mm8JUpmgapgq8ppnBQQSlEkE/
>> https://mailarchive.ietf.org/arch/msg/cfrg/7zhOHPFkCyZC00xLZnsEBT3o6ZU/
>>
>> Please send your comments, as well as expression of support to publish as
>> an RFC (or possible reasons for not doing so) in reply to this message or
>> directly to CFRG chairs.
>>
>>
> [Joe] I have reviewed this draft and I believe it is ready for
> publication.
>
>
>
>> Regards,
>> Stanislav, Nick and Alexey
>> _______________________________________________
>> Cfrg mailing list
>> [email-masked]
>> https://www.irtf.org/mailman/listinfo/cfrg
>>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>