Subject: [CFRG] Domain separation in HPKE

From: "Martin Thomson" <[email-masked]>
Date: Tue, 02 Mar 2021 14:41:26 +1100

HPKE uses string labels for domain separation.  However, this only works because the labels it uses are carefully chosen so that no label is a prefix of any other.  The draft might benefit from mentioning this constraint as it is not obvious.

Also in the text on domain separation:

   One way to ensure this is by using an equal or similar
   prefixing scheme with an identifier different from "HPKE-v1".

LabeledExpand includes a 2-byte value that encodes the output length before this label, so this advice is wrong for that.

---

From: Benjamin Lipp <[email-masked]>
Date: Tue, 2 Mar 2021 16:20:28 +0100

Dear Martin,

Thanks for your remarks.

> HPKE uses string labels for domain separation.  However, this only works because the labels it uses are carefully chosen so that no label is a prefix of any other.  The draft might benefit from men…

The first paragraph of Section 8.5 Domain Separation [1] contains

> […] This is achieved by the different prefix-free label parameters in the calls to LabeledExtract() and LabeledExpand(). […]

Do you think that is sufficient?

> LabeledExpand includes a 2-byte value that encodes the output length before this label, so this advice is wrong for that.

Indeed. I think the advice should instead just be to use LabeledExtract
and LabeledExpand with prefix-free labels, respecting the suite_id as
defined in Section 4 and using a proper kem_id. I drafted a suggestion
in a pull request:
https://github.com/cfrg/draft-irtf-cfrg-hpke/pull/212

Best regards,
Benjamin

[1]
https://cfrg.github.io/draft-irtf-cfrg-hpke/draft-irtf-cfrg-hpke.html#section-8.5