Re: [Cfrg] Multi-recipient public key authenticated encryption

[Phillip Hallam-Baker <[e-mail]>]

It is an interesting question. One approach is to look at it from a systems
angle.

Alice is going to send a message to Bob, Carol and herself. She wants each
to be able to authenticate the message but without being able to prove
Alice sent it (so can't just sign).

Let us begin by assuming we are using ECDH. This means that we are going to
need a keywrap for each recipient under the agreed key. We can generate a
unique input to a MAC at the same time.

So to put the pieces together:

Alice generates an ephemeral key {g^e, e} and an encryption session key k.
She encrypts and authenticates the message resulting in a ciphertext we can
ignore at this point and an authentication tag t.

For each recipient, Alice calculates

IKM_p = (P)^e where P is the recipient public key.
kw_p = WRAP (k, HKDF (IKM, "keywrap"))
Auth_p = HMAC(t, HKDF (IKM, "tagmac"))

So each recipient has an independent verification tag that is derived from
the same key exchange used to encrypt the data for their use.

I am sure this can't be a novel construction simply because it is so
heavily constrained. If we are going to use a MAC to authenticate data, we
must encrypt to data that is only shared bilaterally. Which means we have
to look at the output of the El-Gamal key agreement. Since we have a KDF in
there already, the approach falls out naturally.


The other detail that is commonly missed out is what to do about signing.
Do we sign then encrypt or encrypt then sign?

I use a similar approach to get around the limitations of either approach.
At the protocol level it is almost invariably essential to be able to
verify the signature before decrypting. So if we only calculate one message
digest, it has to be over the ciphertext.

We can however prove that the party who had the ability to access the
plaintext approved signature by creating a witness value as a
one-way function of (k, S, MD(C)) where S is the public signature key and
MD(C) is the message digest of the content.

That is not identical as a signature over the plaintext value but it is
close enough to defeat the application protocol level attacks that come
from assumptions made about ciphertext being signed.

This does not really affect the constructs I use in DARE very much because
I generate the encryption key for each envelope from k by means of unique
per-envelope salt value and a second KDF.