Re: [Cfrg] Multi-recipient public key authenticated encryption

[Peter Gutmann <[e-mail]>]

Neil Madden <[e-mail]> writes:

>Firstly, is an encryption scheme that has been standardized by NIST for 14
>years really exotic? Or do you mean hashing the ciphertext for integrity is
>exotic?

Just because someone wrote about it somewhere in the past doesn't make it non-
exotic.  In particular I don't know which specific "one-pass unified model
from SP 800-56A" you're referring to since SP 800-56A is just a long shopping
list of everything anyone at NIST could come up with, but all of them are
pretty exotic and AFAICT unsupported in major crypto libraries.

>When you say to instead use a signed + encrypted message format, do you mean
>a proper signcryption mode or do you just mean a generic composition of
>signatures and encryption? The latter is what JOSE already supports, and I
>could just have defined a way to remove the extra base64-encoding

My question was really trying to find out whether this was an attempt to fix a
real problem or just an excuse to play around with a fancy crypto scheme, and
if what you're referring to is "6.1.1.2  (Cofactor) Full Unified Model, C(2e,
2s, ECC CDH) Scheme", an extraordinarily awkward and painful one to boot.  It
looks like it's the latter.

Peter.