[CFRG] Re: RG Last Call on draft-irtf-cfrg-hybrid-kems-12 and draft-irtf-cfrg-concrete-hybrid-kems-04

[Ilari Liusvaara <[e-mail]>]

On Sat, Jul 11, 2026 at 11:54:41AM +0000, John Mattsson wrote:
> Hi,
> 
> Neil Madden wrote:
> >NIST SP 800-227 is probably the relevant standard to cite.
> 
> I agree. I also think the draft should adopt the following definition
> from SP 800-227: "preserve the security properties of its component
> KEMs." This is also the definition of a hybrid used in the EU PQC
> Roadmap. I do not think CFRG should specify any hybrids that weaken
> the security properties of one of their components.

This can get problematic with whacky component security properties
(e.g., any MAL binding stuff[1]), properties that transfer in odd ways
(e.g., RER, which I think should be considered baseline), or whacky
application requirements (e.g., requiring explicit rejection).


[1] The MAL adversary is so powerful it can just totally destroy
security of most protocols, making any security model considering
such thing incoherent.




-Ilari