This PR adds MAC modes for HPKE. In the "Auth" and "PSKAuth" modes, this creates a designated verifier signature, in the sense that the message is authenticated as coming from pkI, but only the holder of pkR can verify it.
This would obviously require spec updates, and maybe a rename away from HPKE.
This PR adds MAC modes for HPKE. In the "Auth" and "PSKAuth" modes, this creates a designated verifier signature, in the sense that the message is authenticated as coming from
pkI
, but only the holder ofpkR
can verify it.This would obviously require spec updates, and maybe a rename away from HPKE.