Apply design team decisions

[selfissued]

This PR will apply the design team decisions from 5-Nov-25 at IETF 124 in Montreal. Those decisions were to:

• Not use "enc" when performing Integrated Encryption.
• Define one new Key Management Mode for Integrated Encryption.
• Integrate the new mode into the Message Encryption and Message Decryption instructions from RFC 7516 and replace them.
• Utilize distinct algorithm identifiers for the use of HPKE for Integrated Encryption and HPKE for Key Encryption.
• Only use the Recipient_structure when doing Key Encryption and not when doing Integrated Encryption.

Fixes #42
Fixes #77
Fixes #79

Replaces #83

(The initial commit adds the baseline Message Encryption and Message Decryption instructions without modification (other than conversion from XML to Markdown) so that future commits will make it obvious what the deltas to the instructions in RFC 7516 are.)

Cc: @bc-pi @panva @dwaite @leifj @paulbastian @jogu @kodonog @debcooley

[panva]

@selfissued one missing decision from your bullet point list

• designate distinct "alg" values for Integrated Encryption and Key Encryption modes, e.g. HPKE-0 for IE and HPKE-0+KE for KE (actual values TBD, i'll leave those for the authors to propose)

[selfissued]

Good catch @panva, where you said:

@selfissued one missing decision from your bullet point list

designate distinct "alg" values for Integrated Encryption and Key Encryption modes, e.g. HPKE-0 for IE and HPKE-0+KE for KE (actual values TBD, i'll leave those for the authors to propose)

I've edited the PR description to add this decision to the list.

[hannestschofenig]

Thank you Mike for the super-quick response on this issue! Give me time over the weekend to review the new PR!

[selfissued]

@hannestschofenig I would suggest waiting to review the PR until I've completed it. The initial commit does not instantiate the design team decisions. The primary text change in the PR is to add the baseline Message Encryption and Message Decryption instructions from Sections 5.1 and 5.2 of RFC 7516 without modification (other than conversion from XML to Markdown) so that future commits will make it obvious what the deltas to the instructions this specification introduces are.)

[selfissued]

For your reviewing pleasure, a rendered version of this PR is available at https://self-issued.info/tmp/draft-ietf-jose-hpke-encrypt.html

[ilaril]

Since this construction does not seem to be named, how should another draft that adds a new cipher suite reference the procedures — especially HPKE in Key Encryption / Integrated Encryption — defined in this draft? Repeating the procedures risks divergences, which are very much undesirable.

E.g., how should the two cipher suites with KDF=0x647a (X-Wing), KDF=0x0011 (SHAKE256), AEAD=0x0002 (AES-256-GCM) be defined?

[panva]

I propose to add a section with a summary of all 7516 updates

# Summary of Updates to RFC 7516

This specification updates JSON Web Encryption (JWE) {{RFC7516}} as follows:

- Adds the Integrated Encryption Key Management Mode and
  updates the definition of Key Management Mode ({{terminology}}).

- Updates the "enc" header parameter to be absent when
  Integrated Encryption is used ({{overview}}).

- Replaces the Message Encryption procedure ({{encryption}}).

- Replaces the Message Decryption procedure ({{decryption}}).

- Updates the methods for distinguishing between JWS and JWE objects
  ({{needs-an-anchor}}).

[selfissued]

The summary was added. The rendered draft at https://self-issued.info/tmp/draft-ietf-jose-hpke-encrypt.html been updated.

[konginit]

This PR will apply the design team decisions from 5-Nov-25 at IETF 124 in Montreal. Those decisions were to:

• Not use "enc" when performing Integrated Encryption.
• Define one new Key Management Mode for Integrated Encryption.
• Integrate the new mode into the Message Encryption and Message Decryption instructions from RFC 7516 and replace them.
• Utilize distinct algorithm identifiers for the use of HPKE for Integrated Encryption and HPKE for Key Encryption.
• Only use the Recipient_structure when doing Key Encryption and not when doing Integrated Encryption.

Fixes #42
Fixes #77
Fixes #79

Replaces #83

(The initial commit adds the baseline Message Encryption and Message Decryption instructions without modification (other than conversion from XML to Markdown) so that future commits will make it obvious what the deltas to the instructions in RFC 7516 are.)

Cc: @bc-pi @panva @dwaite @leifj @paulbastian @jogu @kodonog @debcooley