Re: [CFRG] What I want from the "KEM hybrids"

["Salz, Rich" <[e-mail]>]

Again, what myself and—I believe—other implementers are saying in this very thread is that we don't want alternatives. They bring complexity, encourage further proliferation, divide our very finite maintenance resources, and cause Hello Retry Request round-trips.

I tend to agree with this.  I don’t think that swapping out Kyber in a generic combiner would be much less work than building a new “custom”/”unified” algorithm. It also allows the non-generic combiners to leverage properties of the underlying algorithms that make them more efficient and easier to understand and analyze.  A generic combiner can’t make any such simplifying assumptions, which means that they are likely to be more complicated and therefore error-prone, and more likely to be a pointy-side-up rake left for future implementors.

As examples, we don’t have to have any of the discussions about what to hash. And we don’t have to worry about someone replacing X25519 in RSA-PKCS1.5 because it’s what their smartcards have, or because now they can finally get “observability” that TLS1.3 took away with the removal of static RSA key exchange.