Re: [CFRG] Questions for the group from the HPKE presentation

1) I support solving Dan's use case, and I think adding an additional API
call is the right way to do it. However, I see Richard's point that there
might not be a need to extend the document beyond noting the use case and
how to solve it.

2) I support adding codepoints for compressed curve points. However, I
don't support adding deterministic AE, given the security implications of
having no nonce. That said, if we take 2) it might be worth considering
adding nonce-misuse resistant AE schemes, such as AES-GCM-SIV, as these
would provide some assurance in case the new API call is misused.

Best,
Chris P.

On Fri, Aug 6, 2021 at 3:31 PM Nick Sullivan <nick=
40cloudflare.com@dmarc.ietf.org> wrote:

> Dear CFRG participants,
>
> At IETF 111, Dan Harkins made a presentation
> <https://datatracker.ietf.org/meeting/111/materials/slides-111-cfrg-new-kems-and-aeads-for-hpke-00>
> with two proposals:
> - a proposal to define new codepoints for HPKE representing new KEMs for
> compressed NIST points
> - a proposal to define new codepoints to support deterministic
> authenticated encryption schemes that don't use a nonce. This is in service
> of the use case of out-of-order delivery of ciphertexts. *In the
> discussion, it was noted that HPKE uses a nonce to ensure that it never
> leaks whether the same plaintext was encrypted twice and that this proposal
> does not provide this security property.*
>
> Also during the discussion, an alternative proposal was made to solve the
> out-of-order use case: modify the API for HPKE to enable the user to reset
> the nonce counter. This API would enable out-of-order delivery of
> ciphertexts with existing HPKE AEADs.
>
> The chairs would like to ask the group a few questions:
> 1) Does the research group support adding an API to HPKE for resetting the
> nonce counter?
> 2) Is there interest in pursuing a work item to explore defining either of
> the following:
> - new codepoints for compressed curve points in HPKE?
> - new codepoints for deterministic authenticated encryption in HPKE (given the
> answer to (1) was no)?
>
>
>
> Regards,
> Nick (for the chairs)
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>