Subject: [Cfrg] IETF's secure messaging v public-key encryption

From: Dan Brown <[email-masked]>
Date: Fri, 5 Apr 2013 15:48:01 +0000

Dear CFRG list:

Some IETF protocols, including CMS (and perhaps JOSE), offer schemes that are essentially public-key encryption: they protect a conveyed message from an unauthenticated (cryptographically anonymous) sender (**) to a recipient with a public key, with the wrinkle that they also permit multiple recipients (sharing a common "wrapped" key).

Although the sender has no authenticated key, the sender still applies a MAC to the message.  This application of a MAC has been called "authenticated" (with respect to whoever has the MAC key) in some places. It has also been called "integrity-protection" in other places.

Past versions of CMS message encryption did not apply the MAC. Consequently, the integrity of an encrypted message was not protected.

It seems that the purpose of the MACing corresponds closely to the cryptographers' notion of "non-malleability" (NM) goal public-key encryption schemes.  (If I recall correctly, NM-CCA2 has been proven equivalent to IND-CCA2.)

Questions:

1) Do the existing and proposed IETF public-key message encryption methods meet the cryptographer's benchmark of IND-CCA2 security? How important is that to meet these goals?  Can (or have) these cryptographer's security goals be proven for the specific CMS methods?

2) What is the best terminology to use in IETF?  How important is terminology?  Should the existing IETF terminology be amended?

3) What is the right formal definition when multiple recipients are involved?

I seek your answers, but here are my tentative answers:

1) The current proposals provide IND-CCA2.  It would be very hard to prove this (*).  It is important to provide at least IND-CCA1 security, but CCA2 is never really necessary.

2) "Non-malleability" is the best terminology for many general users, at least from my experience. Standard terminology is important, for mutual understanding, and accident avoidance.  The term "authenticated" should either removed when the sender does not use an authenticated key, or else change the term to "recipient-authenticated" (compare TLS and server authentication versus client authentication...).

3) The security definitions should be nearly the same for multiple recipients (which share a common symmetric key).

(*) Shoup [ISO 18033-2] introduced the KEM-DEM approach to hybrid PKE schemes, which may be highly useful for describing, and proving things about, the CMS methods.  I vaguely recall some research done in this area.

(**) In a separate message, I will discuss schemes in which the sender can also be authenticated by means of an authenticated key (but does not sign).

Best regards,

Daniel Brown

Research In Motion Limited

---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.

---

From: "Paterson, Kenny" <[email-masked]>
Date: Fri, 5 Apr 2013 17:41:50 +0000

Dan,

Under item 3 on your list, there is a nice paper
by Nigel Smart at SCN 2004. This gives
security models and constructions for
multi-recipient KEMs, basically what you
are after.

There is related work on
randomness reuse in public key encryption
(probably referenced in Nigel's paper).

Broadcast encryption is yet another related
(yet distinct) topic.

Can you provide pointers to the cms/Jose
schemes you are interested in analysing?

Regards,

Kenny

Sent from my iPhone

On 5 Apr 2013, at 16:48, "Dan Brown" <[email-masked]<mailto:[email-masked]>> wrote:

Dear CFRG list:

It seems that the purpose of the MACing corresponds closely to the cryptographers’ notion of "non-malleability" (NM) goal public-key encryption schemes.  (If I recall correctly, NM-CCA2 has been proven equivalent to IND-CCA2.)

Questions:

1) Do the existing and proposed IETF public-key message encryption methods meet the cryptographer's benchmark of IND-CCA2 security? How important is that to meet these goals?  Can (or have) these cryptographer’s security goals be proven for the specific CMS methods?

Best regards,

Daniel Brown

---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.
_______________________________________________
Cfrg mailing list
[email-masked]<mailto:[email-masked]>
http://www.irtf.org/mailman/listinfo/cfrg

---

From: Dan Brown <[email-masked]>
Date: Fri, 5 Apr 2013 18:39:49 +0000

Kenny,

Thank you for the reference to the Smart paper, I will look for it.

Here are the relevant IETF documents:

CMS:
http://tools.ietf.org/html/rfc5083 (when key management = key transport or ephemeral key agreement)
http://tools.ietf.org/html/rfc6476 (as above)

JOSE:
http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-08 (similar to above)

There may be other IETF documents that do something similar.

Thanks,

Dan

From: [email-masked] [mailto:[email-masked]] On Behalf Of Paterson, Kenny
Sent: Friday, April 05, 2013 1:42 PM
To: Dan Brown
Cc: [email-masked]
Subject: Re: [Cfrg] IETF's secure messaging v public-key encryption

Dan,

There is related work on

Regards,

Kenny

Sent from my iPhone

Questions:

Best regards,

Daniel Brown