Re: [Lake] Some questions about CIPHERTEXT_2 of Message 2 in draft-ietf-lake-edhoc-20

[John Mattsson <[e-mail]>]

Dear Lei YAN,

>I am confused about how the  CIPHERTEXT_2 is calculated.
>In Section 5.3.2 of draft-ietf-lake-edhoc-20, I found there are 2
>sentences that contradict each other.
>¡° * CIPHERTEXT_2 is calculated by using the EDHOC_Expand function as a
>binary additive stream cipher over the following plaintext:
>- PLAINTEXT_2 =...
>...
>- CIPHERTEXT_2 = PLAINTEXT_2 XOR KEYSTREAM_2¡±
>Is the calculation of the CIPHERTEXT_2 using the EDHOC_Expand function or
>just making the XOR operation?

EDHOC_Expand is used to calculate KEYSTREAM_2. CIPHERTEXT_2 is then calculated as CIPHERTEXT_2 = PLAINTEXT_2 XOR KEYSTREAM_2.

I made an issue on GitHub. We will try to reformulate “CIPHERTEXT_2 is calculated by using the EDHOC_Expand function as a binary additive stream cipher over the following plaintext” to make it clearer.

https://github.com/lake-wg/edhoc/issues/431

FYI, there is also a companion document with test vectors that tries to illustrate all the steps.
https://datatracker.ietf.org/doc/draft-ietf-lake-traces/

>Another concern is the security level of the encryption using XOR.
>In Section 9.1 of draft-ietf-lake-edhoc-20: ¡°EDHOC has similar security
>properties as can be expected from the theoretical SIGMA-I protocol
>[SIGMA] and the Noise XX pattern [Noise], which are similar to methods 0
>and 3, respectively.¡±
>However, Section 3.2 of the referenced paper [SIGMA] said the encryption
>of the XOR type is not safe : ¡° In this case the above attack against STS
>is still viable if the encryption is of the XOR type discussed above. In
>this case, when A sends the message { A , sigA(gy, gx) }Ks, Eve replaces
>A¡¯s identity (or certificate) by just XORing the value A ¨’ E in the
>identity location in the ciphertext. When decrypted by B this identity is
>read as E¡¯s and the signature verified also as E¡¯s.¡±

The text in Section 3.2 is analyzing a modified version of the STS protocol and not SIGMA-I. SIGMA-I is analyzed in Section 5.2 where it is stated that “the encryption function (as applied in the third message) must be resistant to active attacks and therefore must combine some form of integrity protection”. Authenticated encryption in the second message does not improve identity protection in SIGMA-I as an active attacker can find the identity of B anyway.

>By the way, is the encryption using XOR quantum-safe?
Yes. Basically all encryption today such as AES-GCM, AES-CCM, ChaCha20-Poly1305 is done with modes that turn them into binary additive stream ciphers, i.e. XOR with a keystream.

Cheers,
John


From: Lake <[e-mail]> on behalf of Yanlei(Ray) <ray.yanlei=[e-mail]>
Date: Thursday, 24 August 2023 at 12:03
To: [e-mail] <[e-mail]>
Subject: [Lake] Some questions about CIPHERTEXT_2 of Message 2 in draft-ietf-lake-edhoc-20
Dear authors,

I am confused about how the  CIPHERTEXT_2 is calculated.
In Section 5.3.2 of draft-ietf-lake-edhoc-20, I found there are 2 sentences that contradict each other.
“ * CIPHERTEXT_2 is calculated by using the EDHOC_Expand function as a binary additive stream cipher over the following plaintext:
- PLAINTEXT_2 =...
...
- CIPHERTEXT_2 = PLAINTEXT_2 XOR KEYSTREAM_2”
Is the calculation of the CIPHERTEXT_2 using the EDHOC_Expand function or just making the XOR operation?

Another concern is the security level of the encryption using XOR.
In Section 9.1 of draft-ietf-lake-edhoc-20: “EDHOC has similar security properties as can be expected from the theoretical SIGMA-I protocol [SIGMA] and the Noise XX pattern [Noise], which are similar to methods 0 and 3, respectively.”
However, Section 3.2 of the referenced paper [SIGMA] said the encryption of the XOR type is not safe : “ In this case the above attack against STS is still viable if the encryption is of the XOR type discussed above. In this case, when A sends the message { A , sigA(gy, gx) }Ks, Eve replaces A’s identity (or certificate) by just XORing the value A ⊕ E in the identity location in the ciphertext. When decrypted by B this identity is read as E’s and the signature verified also as E’s.”
By the way, is the encryption using XOR quantum-safe?

Regards,
Lei YAN