Re: [CFRG] [Technical Errata Reported] RFC9180 (7790)

[Dennis Jackson <[e-mail]>]

On 08/04/2024 22:40, Neil Madden wrote:

> Why do you need to "assess the importance" of the erratum? Either it's 
> valid or it's not.

If something is imperfectly worded,  it's typically marked "Hold For 
Document Update".

>> FWIW, it's not the case that 2-party insider-auth implies multiparty 
>> insider auth - so its pretty irrelevant here.
>>
> But we are talking about the contrapositive here: lack of 2-party 
> insider-auth implies (obviously) lack of multi-party insider-auth. 
> HPKE has neither.
>
>> More significantly and immediately prior to the paragraph you're 
>> concerned about, the RFC details the attack on insider security 
>> presented in the paper at length (9.1.1).
>
> It describes a (related, to be sure) KCI attack. This is not the exact 
> same thing, and it's in a section about KCI. As the paper says, KCI 
> security is a relaxation of Insider-Auth security.

As you wrote above, we're talking about the contrapositive. If KCI is 
violated, obviously Insider-Auth is too.

>> I agree the RFC could be better phrased, but do not think anyone 
>> could read the RFC and conclude that HPKE was proven to achieve 
>> Insider Security - let alone establish the type of Insider Security 
>> being discussed. Further, the paper lays out a clear attack on KCI in 
>> accessible language which is the material consequence of the lack of 
>> insider security anyway.
>>
> Firstly, KCI is not the only consequence of the lack of Insider-Auth, 
> as discussed. Secondly, what are you trying to argue here? That the 
> erratum is incorrect? That incorrect statements should remain in the 
> RFC because... well, what exactly? Because a different paragraph in a 
> different section almost says the right thing?

I'm pointing out as imperfect as the sentence is, a reader is going to 
come away with the correct understanding. Minimally:

  * HPKE is vulnerable to KCI attacks (and if the reader knows what
    Insider-Auth is, therefore doesn't have Insider-Auth).
  * They need to read the referenced paper for the details of exactly
    what properties HPKE is proven to have, where they will find a clear
    statement it does not enjoy Insider-Auth.

As I said previously, if folks need a multi-party HPKE, that seems like 
a good thing for the CFRG to work on.

Best,
Dennis

>
> -- Neil
>
> _______________________________________________
> CFRG mailing list
> [e-mail]
> https://mailman.irtf.org/mailman/listinfo/cfrg