Hybrid Public Key Encryption
draft-irtf-cfrg-hpke-08
Internet Research Task Force (IRTF) R.L. Barnes
Internet-Draft Cisco
Intended status: Informational K. Bhargavan
Expires: 19 August 2021 B. Lipp
Inria
C.A. Wood
Cloudflare
15 February 2021
Hybrid Public Key Encryption
draft-irtf-cfrg-hpke-08
Abstract
This document describes a scheme for hybrid public-key encryption
(HPKE). This scheme provides authenticated public key encryption of
arbitrary-sized plaintexts for a recipient public key. HPKE works
for any combination of an asymmetric key encapsulation mechanism
(KEM), key derivation function (KDF), and authenticated encryption
with additional data (AEAD) encryption function. We provide
instantiations of the scheme using widely used and efficient
primitives, such as Elliptic Curve Diffie-Hellman key agreement,
HKDF, and SHA2.
This document is a product of the Crypto Forum Research Group (CFRG)
in the IRTF.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 19 August 2021.
Barnes, et al. Expires 19 August 2021 [Page 1]
Internet-Draft HPKE February 2021
Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Simplified BSD License text
as described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4
2. Requirements Notation . . . . . . . . . . . . . . . . . . . . 5
3. Notation . . . . . . . . . . . . . . . . . . . . . . . . . . 5
4. Cryptographic Dependencies . . . . . . . . . . . . . . . . . 6
4.1. DH-Based KEM . . . . . . . . . . . . . . . . . . . . . . 8
5. Hybrid Public Key Encryption . . . . . . . . . . . . . . . . 11
5.1. Creating the Encryption Context . . . . . . . . . . . . . 12
5.1.1. Encryption to a Public Key . . . . . . . . . . . . . 15
5.1.2. Authentication using a Pre-Shared Key . . . . . . . . 15
5.1.3. Authentication using an Asymmetric Key . . . . . . . 16
5.1.4. Authentication using both a PSK and an Asymmetric
Key . . . . . . . . . . . . . . . . . . . . . . . . . 16
5.2. Encryption and Decryption . . . . . . . . . . . . . . . . 17
5.3. Secret Export . . . . . . . . . . . . . . . . . . . . . . 19
6. Single-Shot APIs . . . . . . . . . . . . . . . . . . . . . . 19
6.1. Encryption and Decryption . . . . . . . . . . . . . . . . 19
6.2. Secret Export . . . . . . . . . . . . . . . . . . . . . . 20
7. Algorithm Identifiers . . . . . . . . . . . . . . . . . . . . 20
7.1. Key Encapsulation Mechanisms (KEMs) . . . . . . . . . . . 21
7.1.1. SerializePublicKey and DeserializePublicKey . . . . . 21
7.1.2. SerializePrivateKey and DeserializePrivateKey . . . . 22
7.1.3. DeriveKeyPair . . . . . . . . . . . . . . . . . . . . 22
7.1.4. Validation of Inputs and Outputs . . . . . . . . . . 23
7.1.5. Future KEMs . . . . . . . . . . . . . . . . . . . . . 24
7.2. Key Derivation Functions (KDFs) . . . . . . . . . . . . . 24
7.2.1. Input Length Restrictions . . . . . . . . . . . . . . 25
7.3. Authenticated Encryption with Associated Data (AEAD)
Functions . . . . . . . . . . . . . . . . . . . . . . . . 26
8. Security Considerations . . . . . . . . . . . . . . . . . . . 26
Show full document text