Subject: [CFRG] HPKE and AEAD Authentication Tag Length

From: Joseph Salowey <[email-masked]>
Date: Mon, 23 Aug 2021 11:52:29 -0700

In working on a Java HPKE implementation I found that specification does
not specify anything about the authentication tag length for the AEAD
cipher.  I opened issue #283
<https://github.com/cfrg/draft-irtf-cfrg-hpke/issues/238> and proposed PR
239 <https://github.com/cfrg/draft-irtf-cfrg-hpke/pull/239> to address
this.

Cheers,

Joe

---

From: "Martin Thomson" <[email-masked]>
Date: Tue, 24 Aug 2021 11:23:16 +1000

Curiously, the length of the tag is not in contention for any of these AEADs.  It's only if we take on something like CCM or OCB that it becomes relevant.

On Tue, Aug 24, 2021, at 04:52, Joseph Salowey wrote:
> In working on a Java HPKE implementation I found that specification 
> does not specify anything about the authentication tag length for the 
> AEAD cipher.  I opened issue #283 
> <https://github.com/cfrg/draft-irtf-cfrg-hpke/issues/238> and proposed 
> PR 239 <https://github.com/cfrg/draft-irtf-cfrg-hpke/pull/239> to 
> address this.  
> 
> Cheers,
> 
> Joe
> _______________________________________________
> CFRG mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Dan Harkins <[email-masked]>
Date: Mon, 23 Aug 2021 19:17:16 -0700

> Curiously, the length of the tag is not in contention for any of these AEADs.  It's only if we take on something like CCM or OCB that it becomes relevant.

   Actually HPKE's reference for GCM is SP800-38d which says "this 
Recommendation
does not preclude short tags entirely, because knowledgeable security 
professionals
should be able to manage the risks in connection with [a targeted 
forgery attack
described in Appendix B]." Which seems to be exactly the opposite 
approach of HPKE.
HPKE assumes that its users are not knowledgeable security professionals and
therefore must not have tools that could be misused (like control of a 
sequence
number, or deciding on the length of a tag).

   I'm not sure this requires a change though as it seems to fall into 
the "that
which is not permitted is forbidden (for your own good!)" ethos of HPKE.

   Dan.

-- 
"The object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." -- Marcus Aurelius

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 24 Aug 2021 04:13:45 +0000

Dan Harkins <[email-masked]> quotes:

>"knowledgeable security professionals should be able to manage the risks in
>connection with [a targeted forgery attack"

It's "What is an example of the No True Scotsman Fallacy?", Alex.  Do I get my
$400?

Peter.

---

From: Joseph Salowey <[email-masked]>
Date: Mon, 23 Aug 2021 22:24:37 -0700

On Mon, Aug 23, 2021 at 6:24 PM Martin Thomson <[email-masked]> wrote:

> Curiously, the length of the tag is not in contention for any of these
> AEADs.  It's only if we take on something like CCM or OCB that it becomes
> relevant.
>
>
[Joe] There are short length tags defined for AES-GCM [RFC 5282] and some
implementations allow/force you to choose the tag length.   The HPKE draft
points to the NIST document for AES-GCM which also parameterizes the tag
length.   The draft also defines its own registry instead of reusing the
one defined by RFC 5116 which is very specific about tag length.

---

From: Dan Harkins <[email-masked]>
Date: Mon, 23 Aug 2021 23:47:03 -0700

> It's "What is an example of the No True Scotsman Fallacy?", Alex.  Do I get my

    ZZZZzzzzzzztttt! Wrong answer. It's not an appeal to purity, it's 
just an
observation that people who know what they're doing should know how to 
manage
risk.

   Of course, in this day and age of entire countries shuttering over a 
single
case of a viral infection (1 person out of 5,000,000) perhaps such an 
observation
is quaint and nostalgic. Alas, no $400 for you but be sure to stay in 
your bubble
and don't you dare speak to your neighbors.

   Dan.

---

From: denis bider <[email-masked]>
Date: Tue, 24 Aug 2021 17:07:11 -0500

Don't want to spend too much time going off-topic, but:

This mass hysteria is not organic. It is being deliberately caused by
mass media and governments, which are using every single manipulative
approach used by cults.

Take a look at this image, which represents Biderman's Chart of
Coercion (cca 1956). Compare this to what governments and the media
are doing:

https://i.imgur.com/lSjqIsa.jpg

This is NOT innocuous. Governments and media across the world do not
just coincidentally come together and do this.

denis

---

From: Colin Perkins <[email-masked]>
Date: Tue, 24 Aug 2021 23:20:16 +0100

This discussion is off-topic for this list – please take it elsewhere.

Colin

> On 24 Aug 2021, at 23:07, denis bider <[email-masked]> wrote:
> 
>> single case of a viral infection (1 person out of 5,000,000) perhaps such an
>> observation is quaint and nostalgic. Alas, no $400 for you but be sure to stay in
>> your bubble and don't you dare speak to your neighbors.
>> 
>>   Dan.
>> 
>> --

-- 
Colin Perkins
https://csperkins.org/

---

From: denis bider <[email-masked]>
Date: Tue, 24 Aug 2021 17:31:40 -0500

No, fuck you, Colin.

We will not see the world die without a remark.

Fuck you.

denis

---

From: Nick Sullivan <[email-masked]>
Date: Tue, 24 Aug 2021 19:20:25 -0400

Dear CFRG,

We have removed "denis bider" from the CFRG mailing list for
violations of the IETF code of conduct (BCP 54) and have forwarded
this thread to the ombudsteam.

Nick (for the chairs)

---

From: "Christopher Wood" <[email-masked]>
Date: Tue, 24 Aug 2021 17:24:43 -0700

Thanks, Joe! This is a fine clarification. We merged the PR.

Best,
Chris