Post #4033229

2026-07-22 07:23 UTC

@greyarea@mitra.vpclmulqdq.moe >If the proof covers all of that then it's not strictly needed, but it's cheap paranoia. Do you mean id/actor/to of a plaintext activity, or of an envelope (EncryptedActivity)? My understanding is that the properties of an envelope have no effect on security. It can even have a different actor. I added an example of a plaintext activity: https://codeberg.org/silverpill/feps/src/branch/main/0806/fep-0806.md#plaintext-activity Also added HPKE mode to the parameter list - mode_base.

Replies (1)

@greyarea@mitra.vpclmulqdq.moe 2026-07-22 17:42

@silverpill@mitra.social Of an envelope. If actor being changed mid-transit isn't a problem, then omit it from the aad. Including the from/to as part of the AAD binds the ciphertext to the origin/recipient (the HPKE ciphertext does not carry any of this information). It is worth noting that, as the FEP is specified now, using the sender and recipient's keypairs to do HPKE will result in the same shared secret being generated for every message. This is catastrophic to security as the nonce for the symmetric portion of the HPKE encryption is deterministic (RFC 9180 5.1). This can be avoided by either: having the sender generate an ephemeral keypair (include the public key envelope), or using a unique HPKE info per envelope. The former is better as it gives imperfect forward secrecy (sender identity key compromise does not reveal past plaintexts), the latter is cheaper to do.

Open ##4033228