All, Following on to an earlier thread, I have done some experimentation with patching the pycose package to enable draft HPKE algorithms [1]. Some experiences are good and some not so much.
The good experiences are that the overall definitions in the document seem to be complete and consistent. The existing library implementation of HPKE is working; I was able to patch pycose and verify round-trip integrated encryption messages (caveat: tests are self-verifying the messages, see AAD discussion below) with the new header parameter. Also the examples in Section 5 are easy to read and understand. The bad experiences are that the examples in Appendix C are very difficult to read and understand on first viewing, and there is currently a blocking issue to fully aligning off-the-shelf HPKE library [2] with this draft. That existing library implementation takes a strict reading of HPKE RFC 9180 [3], which allows use only of the KDF "info" input and not any access to the AEAD "aad" input. This restriction is quoted below and causes any implementation that follows its guidance to be incompatible with the current COSE HPKE draft. > Applications that only use the single-shot APIs described in Section 6 should use the Setup info parameter for specifying auxiliary authenticated information. Implementations which only expose single-shot APIs should not allow applications to use both Setup info and Context aad or exporter_context auxiliary information parameters. I understand that this is the choice of the library author to adhere to non-normative guidance of RFC 9180, but presumably that guidance was written for a reason and HPKE implementations already exist with corresponding limitations. One huge benefit that I see of using HPKE algorithms in COSE is to take advantage of libraries where possible. How do the authors feel about removing use of the HPKE "aad" input and use only the "info" input? I don't think it would change the fundamental behavior of binding to that COSE Enc_structure or Recipient_structure context. Brian S. [1] https://www.ietf.org/archive/id/draft-ietf-cose-hpke-26.html#section-3.2 [2] https://cryptography.io/en/latest/hazmat/primitives/hpke/ [3] https://datatracker.ietf.org/doc/html/rfc9180.html#section-8.1
_______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
