Make Session Initialization Implicit #364

A session is now initialized by generating keys and sharing them out of band. The semantics of the protocol are otherwise unchanged. Because sessions are implicit the typestate is now called `Receiver`.

Encrypting Message A with an ephemeral "encapsulation key" allows the sender "reply key" corresponding to its subdirectory to be hidden from the directory.

Since the encapsulation keypair was ephemeral and not known to the receiver, but used in the Auth pattern it was included as authenticated associated data in the payload. This means that encrypt_message_a and encrypt_message_b had distinguishable bit patterns, the former starting with two uncompressed curve points (one for the DHKEM and one for this auth key), whereas the latter only had one (the DHKEM point). Since the sender's first message establishes a reply key, that key could be used in a second Auth HPKE setup after the Base setup, in order to prove that the sender can decrypt the receiver's reply. However, incentives are for the sender to provide a valid point, and the reply key is included in AEAD ciphertext, so this would add complexity without meaningful improving security or incentive compatibility.

The constants PADDED_PLAINTEXT_{A,B}_LENGTH now represent the maximum payload size for the input, whereas before the message A constant included the reply key size. This makes the PayloadTooLarge error represent a maximum and actual size that correspond to the inputs to encrypt_message_a and encrypt_message_b.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make Session Initialization Implicit #364

Make Session Initialization Implicit #364

Commits on Oct 21, 2024