Subject: [Cfrg] HPKE, message lengths, and IND-CCA2

From: John Mattsson <[email-masked]>
Date: Fri, 23 Oct 2020 08:53:53 +0000

HI,

While the theoretical IND-CCA2 game assumes that the attacker generates messages with a fixed lengths, this is not very realistic in reality where messages often has variable length. It would be good to inform the reader that the specified mechanism does nothing to hide the length of the encrypted message, and if this is a concern, the user needs to use a padding mechanism The draft could also e.g. suggest how to do padding, e.g. the bit padding mechanism combined with one of the padding policies from

https://tools.ietf.org/html/draft-ietf-tls-esni-08
https://tools.ietf.org/html/rfc8467

Cheers,
John

---

From: "Christopher Wood" <[email-masked]>
Date: Fri, 23 Oct 2020 09:02:08 -0700

Thanks for raising this, John! We addressed this in the following PR:

   https://github.com/cfrg/draft-irtf-cfrg-hpke/pull/166

Best,
Chris

On Fri, Oct 23, 2020, at 1:53 AM, John Mattsson wrote:
> HI,
> 
> While the theoretical IND-CCA2 game assumes that the attacker generates 
> messages with a fixed lengths, this is not very realistic in reality 
> where messages often has variable length. It would be good to inform 
> the reader that the specified mechanism does nothing to hide the length 
> of the encrypted message, and if this is a concern, the user needs to 
> use a padding mechanism The draft could also e.g. suggest how to do 
> padding, e.g. the bit padding mechanism combined with one of the 
> padding policies from
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>