RFC 9180: Hybrid Public Key Encryption (2022)

&gt; HPKE is not tolerant of lost messages. [1]<p>This seems a severe limitation for certain applications (e.g. VPNs) which tunnel traffic which already has an ordering mechanism (such as TCP) [2]. This is not a limitation of, e.g., Noise [3], one of the existing hybrid protocols HPKE seems intended to replace.<p>[1] <a href="https:&#x2F;&#x2F;www.rfc-editor.org&#x2F;rfc&#x2F;rfc9180.html#name-message-order-and-message-l" rel="nofollow">https:&#x2F;&#x2F;www.rfc-editor.org&#x2F;rfc&#x2F;rfc9180.html#name-message-ord...</a><p>[2] <a href="https:&#x2F;&#x2F;openvpn.net&#x2F;faq&#x2F;what-is-tcp-meltdown&#x2F;" rel="nofollow">https:&#x2F;&#x2F;openvpn.net&#x2F;faq&#x2F;what-is-tcp-meltdown&#x2F;</a><p>[3] <a href="https:&#x2F;&#x2F;noiseprotocol.org&#x2F;noise.html#out-of-order-transport-messages" rel="nofollow">https:&#x2F;&#x2F;noiseprotocol.org&#x2F;noise.html#out-of-order-transport-...</a>

(2022.)<p>And because people often misunderstand RFCs as being &quot;official&quot;:<p>&gt; <i>This document is not an Internet Standards Track specification; it is published for informational purposes.</i><p>&gt; <i>This document is a product of the Internet Research Task Force (IRTF). The IRTF publishes the results of Internet-related research and development activities. These results might not be suitable for deployment. This RFC represents the consensus of the Crypto Forum Research Group of the Internet Research Task Force (IRTF). Documents approved for publication by the IRSG are not candidates for any level of Internet Standard; see Section 2 of RFC 7841.</i>

The introduction says that HPKE is different from the “traditional combination” of “encrypt the symmetric key with the public key”, but it doesn’t explain why it’s better. Does anyone know?

Similarly: <a href="http:&#x2F;&#x2F;www.noiseprotocol.org&#x2F;noise.html" rel="nofollow">http:&#x2F;&#x2F;www.noiseprotocol.org&#x2F;noise.html</a>

&gt; Currently, there are numerous competing and non-interoperable standards and variants for hybrid encryption …<p>Sure, let’s create another one and expect it being used by all othe those who use existing stabdards.<p>It would be great to understand the exact specific motive which drives it instead of converging on an existing standard.

I <i>hate</i> that they call the authentication key arrangements in this &quot;key scheduling&quot;.