Re: [lamps] I-D Action: draft-ietf-lamps-rfc4210bis-04.txt

["Brockhaus, Hendrik" <[e-mail]>]

Russ

Thank you for clarifying you issue. I am sorry that our description does not make 
things clearer.

> Von: Russ Housley <[e-mail]>
> 
> Hendrik:
> 
> Trimming for readability ...
> 
> >>>>>
> >>>>> [HB] Section 5.1.3.4 is about PKIMessage protection using MAC-based
> >>>> protection.
> >>>>> We want to achieve message authentication, but no confidentiality.
> >>>>
> >>>> Hendrik, it is now clear to me that I totally misunderstood your
> approach.
> >>>> Normally, when people talk about HPKE (Hybrid Public Key Encryption)
> they
> >> are
> >>>> talking about the combination of key management and authenticated
> >>>> encryption.  You are not.  You are only planning to use HPKE Secret
> Export.  I
> >>>> suggest you add "Secret Export" to keep others from going down the
> same
> >> path.
> >>>
> >>> [HB] I will add a hint to secret export to the introductory paragraph.
> >>>
> >>> OLD
> >>>  Both PKI entities require a certificate of the other side and send a
> >>>  symmetric key in form of a KEM encapsulated ciphertext according to
> >>>  Hybrid Public Key Encryption [RFC9180] to the respective recipient.
> >>>
> >>> NEW
> >>>  Both PKI entities require a certificate of the other side and send a
> >>>  symmetric key in form of a KEM encapsulated ciphertext using the
> >>>  secret export APIs as specified in Hybrid Public Key Encryption
> >>>  Section 6.2 [RFC9180] to the respective recipient.
> >>
> >> I do not see where the public key of the sender comes into the algorithms
> in
> >> Section 6.2 of RFC 9180.  So, why do both PKI entities require certificates?
> >
> > [HB] The shared symmetric key shall be mutually authenticated. Both sides
> > contribute to the MAC key with an KEM encapsulation using the public key
> > from the certificate of the other side.
> > Or do I miss something ?-)
> 
> From Section 6.2 of RFC 9180:
> 
>    def SendExport<MODE>(pkR, info, exporter_context, L, ...):
>      enc, ctx = Setup<MODE>S(pkR, info, ...)
>      exported = ctx.Export(exporter_context, L)
>      return enc, exported
> 
>    def ReceiveExport<MODE>(enc, skR, info, exporter_context, L, ...):
>      ctx = Setup<MODE>R(enc, skR, info, ...)
>      return ctx.Export(exporter_context, L)
> 
> SendExport uses the recipient's public key.  Nothing from the sender is
> involved.
> 
> ReceiveExport uses the recipient's private key.  Nothing from the sender is
> involved.
> 
> Thus, the HPKE Secret Export does not provide authentication of the sender.
> Some other mechanism would beed to be used in conjunction with HPKE
> Secret Export to do so.

[HB] You are absolutely right. This is why we apply HPKE twice, the first time using the CMP client's public/private key. The second time we use the CMP server's public/private key and the shared secret key from the first HPKE into the exporter_context parameter of the SendExportBase function. Doing so we believe that we receive a mutually authenticated shared secret key from the second HPKE.
For more clarity I could explicitly state in the text that 'context' is also used with the exporter function.

OLD
       It concatenates the shared secret ss1, with the transactionID,
       the senderNonce genp_senderNonce, and the recipNonce
       genp_recipNonce from the PKIHeader of the received genp message
       to context2.

        context2 = concat(ss1, transactionID, genp_senderNonce,
                          genp_recipNonce)

       It generates a shared secret ss2 and the associated ciphertext
       enc2 using the HPKE export function SendExportBase and the
       server's public key pkS:

        SendExportBase(pkS, "round2", context2, len) = (enc2, ss2)

NEW
       It concatenates the shared secret ss1, with the transactionID,
       the senderNonce genp_senderNonce, and the recipNonce
       genp_recipNonce from the PKIHeader of the received genp message
       to context2.

        context2 = concat(ss1, transactionID, genp_senderNonce,
                          genp_recipNonce)

       It generates a shared secret ss2 and the associated ciphertext
       enc2 using the HPKE export function SendExportBase with the
       server's public key pkS and context2:

        SendExportBase(pkS, "round2", context2, len) = (enc2, ss2)

Hendrik