All,
Following on to an earlier thread, I have done some experimentation with
patching the pycose package to enable draft HPKE algorithms [1]. Some
experiences are good and some not so much.

The good experiences are that the overall definitions in the document seem
to be complete and consistent. The existing library implementation of HPKE
is working; I was able to patch pycose and verify round-trip integrated
encryption messages (caveat: tests are self-verifying the messages, see AAD
discussion below) with the new header parameter. Also the examples in
Section 5 are easy to read and understand.
The bad experiences are that the examples in Appendix C are very difficult
to read and understand on first viewing, and there is currently a blocking
issue to fully aligning off-the-shelf HPKE library [2] with this draft.

That existing library implementation takes a strict reading of HPKE RFC
9180 [3], which allows use only of the KDF "info" input and not any access
to the AEAD "aad" input. This restriction is quoted below and causes any
implementation that follows its guidance to be incompatible with the
current COSE HPKE draft.
> Applications that only use the single-shot APIs described in Section 6
should use the Setup info parameter for specifying auxiliary authenticated
information. Implementations which only expose single-shot APIs should not
allow applications to use both Setup info and Context aad or
exporter_context auxiliary information parameters.

I understand that this is the choice of the library author to adhere to
non-normative guidance of RFC 9180, but presumably that guidance was
written for a reason and HPKE implementations already exist with
corresponding limitations. One huge benefit that I see of using HPKE
algorithms in COSE is to take advantage of libraries where possible.

How do the authors feel about removing use of the HPKE "aad" input and use
only the "info" input? I don't think it would change the
fundamental behavior of binding to that COSE Enc_structure or
Recipient_structure context.

Brian S.

[1] https://www.ietf.org/archive/id/draft-ietf-cose-hpke-26.html#section-3.2
[2] https://cryptography.io/en/latest/hazmat/primitives/hpke/
[3] https://datatracker.ietf.org/doc/html/rfc9180.html#section-8.1
_______________________________________________
COSE mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to