[ippm] Orie Steele's Discuss on draft-ietf-ippm-encrypted-pdmv2-09: (with DISCUSS)

[Orie Steele via Datatracker <[e-mail]>]

Orie Steele has entered the following ballot position for
draft-ietf-ippm-encrypted-pdmv2-09: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ippm-encrypted-pdmv2/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thanks to Marc Blanchet for the ARTART review.

I agree with his comments.

I think the appendix section A.2 should probably be removed.

If it is necessary to specify the details of HPKE more concretely, that should
be done in the body of the document.

I also agree with Roman's DISCUSS on mandatory to implement algorithms and HPKE.

### Discuss

HPKE has a PSK Mode (and AuthKEM Mode), but this document does not mention
which modes of HPKE are supported.

It was not obvious to me how the salt and nonce values are used.

Typically HPKE supports auxiliary application information using info and aad:

https://datatracker.ietf.org/doc/html/rfc9180#name-auxiliary-authenticated-app

I see this sentence:

Encrypted PDMv2 has most of the metadata fields encrypted except for PSNTP
which is also used as a nonce in HPKE AEAD.

I would suggest explaining exactly what you are setting the value of "info" and
"aad" too, and perhaps include some test vectors.