Subject: [Cfrg] comments on provable security of draft-irtf-cfrg-hpke

From: Benjamin Lipp <[email-masked]>
Date: Tue, 2 Jun 2020 22:51:14 +0200

Dear CFRG,

I have carefully reviewed the HPKE draft, mostly from a provable
security point-of-view. All issues I raised to the authors have been
fixed in collaboration with them before the RGLC. I think the document
is ready to go as soon as the pending (minor and editorial) comments
have been addressed.

A write-up of a mechanized computational analysis (game-based security
proof) done with CryptoVerif is available at [1], however it is outdated
since the changes made to the draft with this pull request [2]; this
pull request mainly added a KDF to DHKEM and labels to all Extract
calls. Proofs for the current version of DHKEM are available at [3]
(without write-up yet). This analysis is ongoing to further refine the
security notions and update the proofs accordingly.

Best regards,
Benjamin

[1] https://eprint.iacr.org/2020/243
[2] https://github.com/cfrg/draft-irtf-cfrg-hpke/pull/50
[3] https://github.com/blipp/hpke-analysis-material