[CFRG] Questions for the group from the HPKE presentation

[Nick Sullivan <[e-mail]>]

Dear CFRG participants,

At IETF 111, Dan Harkins made a presentation
<https://datatracker.ietf.org/meeting/111/materials/slides-111-cfrg-new-kems-and-aeads-for-hpke-00>
with two proposals:
- a proposal to define new codepoints for HPKE representing new KEMs for
compressed NIST points
- a proposal to define new codepoints to support deterministic
authenticated encryption schemes that don't use a nonce. This is in service
of the use case of out-of-order delivery of ciphertexts. *In the
discussion, it was noted that HPKE uses a nonce to ensure that it never
leaks whether the same plaintext was encrypted twice and that this proposal
does not provide this security property.*

Also during the discussion, an alternative proposal was made to solve the
out-of-order use case: modify the API for HPKE to enable the user to reset
the nonce counter. This API would enable out-of-order delivery of
ciphertexts with existing HPKE AEADs.

The chairs would like to ask the group a few questions:
1) Does the research group support adding an API to HPKE for resetting the
nonce counter?
2) Is there interest in pursuing a work item to explore defining either of
the following:
- new codepoints for compressed curve points in HPKE?
- new codepoints for deterministic authenticated encryption in HPKE (given the
answer to (1) was no)?



Regards,
Nick (for the chairs)