Hi Brian, This is great feedback. I think we should take your advice.
Regards, OS (just 1 author) On Mon, Jul 20, 2026 at 5:13 PM Brian Sipos <[email protected]> wrote: > All, > Following on to an earlier thread, I have done some experimentation with > patching the pycose package to enable draft HPKE algorithms [1]. Some > experiences are good and some not so much. > > The good experiences are that the overall definitions in the document seem > to be complete and consistent. The existing library implementation of HPKE > is working; I was able to patch pycose and verify round-trip integrated > encryption messages (caveat: tests are self-verifying the messages, see AAD > discussion below) with the new header parameter. Also the examples in > Section 5 are easy to read and understand. > The bad experiences are that the examples in Appendix C are very difficult > to read and understand on first viewing, and there is currently a blocking > issue to fully aligning off-the-shelf HPKE library [2] with this draft. > > That existing library implementation takes a strict reading of HPKE RFC > 9180 [3], which allows use only of the KDF "info" input and not any access > to the AEAD "aad" input. This restriction is quoted below and causes any > implementation that follows its guidance to be incompatible with the > current COSE HPKE draft. > > Applications that only use the single-shot APIs described in Section 6 > should use the Setup info parameter for specifying auxiliary authenticated > information. Implementations which only expose single-shot APIs should not > allow applications to use both Setup info and Context aad or > exporter_context auxiliary information parameters. > > I understand that this is the choice of the library author to adhere to > non-normative guidance of RFC 9180, but presumably that guidance was > written for a reason and HPKE implementations already exist with > corresponding limitations. One huge benefit that I see of using HPKE > algorithms in COSE is to take advantage of libraries where possible. > > How do the authors feel about removing use of the HPKE "aad" input and use > only the "info" input? I don't think it would change the > fundamental behavior of binding to that COSE Enc_structure or > Recipient_structure context. > > Brian S. > > [1] > https://www.ietf.org/archive/id/draft-ietf-cose-hpke-26.html#section-3.2 > [2] https://cryptography.io/en/latest/hazmat/primitives/hpke/ > [3] https://datatracker.ietf.org/doc/html/rfc9180.html#section-8.1 >
_______________________________________________ COSE mailing list -- [email protected] To unsubscribe send an email to [email protected]
