Re: [Crypto-panel] Request for review: draft-irtf-cfrg-dnhpke-03

["Harkins, Dan" <[e-mail]>]

  Hi Scott,

  Thanks for your review. The oddities of Outlook (in which I am a piker) are essentially requiring a top quote response because it's putting my text response in the body of your message in the same color as the background and not letting me override it. Anyway, pardon the top quote....

  Yes, I will use the RFC 5297 names, thanks for the suggestion.

  The randomness inserted by the injector would only apply in the "single shot" mode of HPKE. Subsequent encryptions would require the encryptor to inject randomness in the plaintext as the key does not change with additional encryption calls-- hence the use of nonces/counters in AEAD modes. AES-SIV (per RFC 5297) optionally takes a nonce/counter but my use of it in the proposed HPKE changes do not use it so it really is a deterministic cipher mode. It's like AES Key Wrap in that sense, only SIV has a security proof, is much more efficient, and encrypts data with natural lengths without requiring padding. 

  The random point contributed by the encryptor will only result in a secret key (per ECDH) whose value is "random" in the space of points in the curve. But to get semantic security on multiple AES-SIV encryptions using that singular (and "random") encryption key requires the message space to be "random enough". 

  So I don't think calling it "deterministic" is wrong. If you disagree with this please let's discuss further.

  Also, there are no bytes saved on the wire. In HPKE the counter is an internal datum which the user has no control over. It is never exported and there is no import mechanism defined (although apparently Stephen Farrell defined one for OpenSSL). HPKE output is always the serialized ephemeral contribution of the encryptor concatenated with the output of the cipher mode. That is the same whether the cipher mode is AES-GCM or AES-SIV. There are no byte savings, it's just that with AES-SIV there is no counter used in the internal HPKE context, hence the determinism and the applicability for lossy networks.

  Thanks for pointing out the typos! I'll fix them in the next version.

  regards,

  Dan.

--
"the object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." – Marcus Aurelius
 
On 11/28/23, 12:34 PM, "Scott Fluhrer (sfluhrer)" <[e-mail]> wrote:

    Ok, I went through the draft, it mostly looks good.  I do have the following comments:
    
    - You define the ciphersuites "AES-256-SIV" and "AES-512-SIV".  However, RFC 5297 has AEAD_AES_SIV_CMAC_256 and 512 - are those the same thing?  If so, you might want to make the names consistent.
    
    - Calling it 'deterministic' feels wrong - the encryptor injects randomness (by his part of the ephemeral key exchange).  I realize why you call it deterministic (because the symmetric part is); I would consider some discussion of this.
    
    	- Because of this, much of the discussion that you put about deterministic encryption being safe if the message space is "random enough" can be replaced by the simple requirement that the encryptor always selects his point randomly.
    
    - In section 1.2 (addressing lossy networks), you said that one of the things you did to address that is to make things deterministic.  Actually, you didn't do that for that reason - instead, you did it to save a few bytes on the wire.
    
    Typos:
    
    - Section 1.2: "impracticle" -> "impractical"
    
    - Section 1.2.1: "pre-peneded" -> "prepended"
    
    - Section 1.2.1: "Determinsitic" -> "Deterministic"
    
    > -----Original Message-----
    > From: Scott Fluhrer (sfluhrer)
    > Sent: Thursday, November 16, 2023 10:21 AM
    > To: Alexey Melnikov <[e-mail]>; [e-mail]
    > Cc: [e-mail]; [e-mail]
    > Subject: RE: [Crypto-panel] Request for review: draft-irtf-cfrg-dnhpke-03
    > 
    > I'll take a look at it...
    > 
    > > -----Original Message-----
    > > From: Crypto-panel <[e-mail]> On Behalf Of Alexey
    > > Melnikov
    > > Sent: Thursday, November 16, 2023 9:53 AM
    > > To: [e-mail]
    > > Cc: [e-mail]; [e-mail]
    > > Subject: [Crypto-panel] Request for review: draft-irtf-cfrg-dnhpke-03
    > >
    > > Dear Crypto Panel Experts,
    > >
    > > The chairs would like to ask the Crypto Panel to provide another
    > > review for draft-irtf-cfrg-dnhpke-03, "Deterministic Nonce-less Hybrid
    > > Public Key Encryption"
    > > (https://datatracker.ietf.org/doc/draft-irtf-cfrg-dnhpke/ ). In
    > > particular, chairs would like to understand from the review whether
    > > the provided extension to HPKE is reasonable and whether it is well
    > specified.
    > >
    > > Best Regards,
    > > Alexey (on behalf of the CFRG Chairs)
    > >
    > > _______________________________________________
    > > Crypto-panel mailing list
    > > [e-mail]
    > > https://mailman.irtf.org/mailman/listinfo/crypto-panel