[CFRG] Fwd: [pqc-forum] Ordering of Shared Secrets in SP 800-56C Combiner

[Deirdre Connolly <[e-mail]>]

---------- Forwarded message ---------
From: 'Robinson, Angela Y. (Fed)' via pqc-forum <[e-mail]>
Date: Tue, Nov 19, 2024, 5:49 PM
Subject: [pqc-forum] Ordering of Shared Secrets in SP 800-56C Combiner
To: pqc-forum <[e-mail]>


Dear All,



The key-derivation methods described in NIST SP 800-56C are currently only
applicable to shared secrets established during a key establishment scheme
as specified in NIST SP 80056A or 800-56B, or to Z = Z’||T which is the
combination of shared secret Z’ that was generated as specified in SP
800-56A or -56B with another shared secret T that is generated in any way.
As previously stated, NIST intends to allow all key-derivation methods in
NIST SP 800-56C to apply to the outputs of the ML-KEM key establishment
scheme specified in FIPS 203.



Further, NIST intends to allow the 800-56C key derivation methods to apply
to shared secrets of the form Z = T || Z’, where T and Z’ are as described
above but in reverse order.  That is, we will ensure that either order is
allowed for FIPS validation in upcoming revisions to -56C.  Note, however,
that the order of the shared secrets will need to be specified at the
protocol level to avoid confusion.  We are working on guidance to ensure
that this reordering will not introduce security vulnerabilities.  NIST is
open to feedback on the matter.





Angela

NIST PQC

-- 
You received this message because you are subscribed to the Google Groups
"pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to [e-mail].
To view this discussion visit
https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/CO6PR09MB797555BA77527376183DDF1C8E202%40CO6PR09MB7975.namprd09.prod.outlook.com
<https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/CO6PR09MB797555BA77527376183DDF1C8E202%40CO6PR09MB7975.namprd09.prod.outlook.com?utm_medium=email&utm_source=footer>
.