RFC 9180 - Hybrid Public Key Encryption

Published: February 2022
Category: Informational
Authors: R. Barnes (Cisco), K. Bhargavan, B. Lipp (Inria), C. Wood (Cloudflare)

Abstract

This document describes a scheme for hybrid public key encryption (HPKE). This scheme provides a variant of public key encryption of arbitrary-sized plaintexts for a recipient public key. It also includes three authenticated variants, including one that authenticates possession of a pre-shared key and two optional ones that authenticate possession of a key encapsulation mechanism (KEM) private key. HPKE works for any combination of an asymmetric KEM, key derivation function (KDF), and authenticated encryption with additional data (AEAD) encryption function. Some authenticated variants may not be supported by all KEMs. We provide instantiations of the scheme using widely used and efficient primitives, such as Elliptic Curve Diffie-Hellman (ECDH) key agreement, HMAC-based key derivation function (HKDF), and SHA2.

This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF.

Status of This Memo

This document is not an Internet Standards Track specification; it is published for informational purposes.

This document is a product of the Internet Research Task Force (IRTF). The IRTF publishes the results of Internet-related research and development activities. These results might not be suitable for deployment. This RFC represents the consensus of the Crypto Forum Research Group of the Internet Research Task Force (IRTF). Documents approved for publication by the IRSG are not candidates for any level of Internet Standard; see Section 2 of RFC 7841.

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc9180.

Copyright Notice

Copyright (c) 2022 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.

Contents

• 1. Introduction
• 2. Requirements Notation
• 3. Notation
• 4. Cryptographic Dependencies
  • 4.1 DH-Based KEM (DHKEM)
• 5. Hybrid Public Key Encryption
  • 5.1 Creating the Encryption Context
    • 5.1.1 Encryption to a Public Key
    • 5.1.2 Authentication Using a Pre-Shared Key
    • 5.1.3 Authentication Using an Asymmetric Key
    • 5.1.4 Authentication Using Both a PSK and an Asymmetric Key
  • 5.2 Encryption and Decryption
  • 5.3 Secret Export
• 6. Single-Shot APIs
  • 6.1 Encryption and Decryption
  • 6.2 Secret Export
• 7. Algorithm Identifiers
  • 7.1 Key Encapsulation Mechanisms (KEMs)
    • 7.1.1 SerializePublicKey and DeserializePublicKey
    • 7.1.2 SerializePrivateKey and DeserializePrivateKey
    • 7.1.3 DeriveKeyPair
    • 7.1.4 Validation of Inputs and Outputs
    • 7.1.5 Future KEMs
  • 7.2 Key Derivation Functions (KDFs)
    • 7.2.1 Input Length Restrictions
  • 7.3 Authenticated Encryption with Associated Data (AEAD) Functions
• 8. API Considerations
  • 8.1 Auxiliary Authenticated Application Information
  • 8.2 Errors
• 9. Security Considerations
  • 9.1 Security Properties
    • 9.1.1 Key-Compromise Impersonation
    • 9.1.2 Computational Analysis
    • 9.1.3 Post-Quantum Security
  • 9.2 Security Requirements on a KEM Used within HPKE
    • 9.2.1 Encap/Decap Interface
    • 9.2.2 AuthEncap/AuthDecap Interface
    • 9.2.3 KEM Key Reuse
  • 9.3 Security Requirements on a KDF
  • 9.4 Security Requirements on an AEAD
  • 9.5 Pre-Shared Key Recommendations
  • 9.6 Domain Separation
  • 9.7 Application Embedding and Non-Goals
    • 9.7.1 Message Order and Message Loss
    • 9.7.2 Downgrade Prevention
    • 9.7.3 Replay Protection
    • 9.7.4 Forward Secrecy
    • 9.7.5 Bad Ephemeral Randomness
    • 9.7.6 Hiding Plaintext Length
  • 9.8 Bidirectional Encryption
  • 9.9 Metadata Protection
• 10. Message Encoding
• 11. IANA Considerations
  • 11.1 KEM Identifiers
  • 11.2 KDF Identifiers
  • 11.3 AEAD Identifiers
• 12. References
  • 12.1 Normative References
  • 12.2 Informative References
• Appendix A. Test Vectors
  • A.1 DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-128-GCM
  • A.2 DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, ChaCha20Poly1305
  • A.3 DHKEM(P-256, HKDF-SHA256), HKDF-SHA256, AES-128-GCM
  • A.4 DHKEM(P-256, HKDF-SHA256), HKDF-SHA512, AES-128-GCM
  • A.5 DHKEM(P-256, HKDF-SHA256), HKDF-SHA256, ChaCha20Poly1305
  • A.6 DHKEM(P-521, HKDF-SHA512), HKDF-SHA512, AES-256-GCM
  • A.7 DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, Export-Only AEAD
• Acknowledgements
• Authors' Addresses