[CFRG] Re: RG Last Call on draft-irtf-cfrg-hybrid-kems-12 and draft-irtf-cfrg-concrete-hybrid-kems-04

[Ilari Liusvaara <[e-mail]>]

With the composite KEMs and signatures, the issue is not the many
combiners. It is the combinatorial explosion of algorithm pairs, all
incompatible.  Neither LAMPS composite-sigs (18 options) nor
composite-kems (12 options) has any combiner choices.

And while dual certificates would offer way out of combinatorial
explosion, those do not fit the current APIs, which is a very
serious problem.

And with regards to KEM situation, it has two subcases: Asymmetric
encryption and Key Exchange.

With Asymmetric Encryption, it is only better in X-Wing exists and is
widely supported.

And with Key Exchange, it is better in that algorithm agility makes
options much much cheaper. So for example TLS 1.3 having 8 options is
no problem (and I have heard requests for 9th, but so far nobody has
made the I-D).

And these three cases are all quite different. And Key Exchange is very
different from others.

Also, if some comment mentioning ML-KEM or ML-DSA makes little sense, it
might be because commenter mixed the two up. I have seen that happen
many times.

And with regards to CFRG, I see repeat of a mistake with the signatures
work. Back then, CFRG wasted a lot of time with Ed25519. Now it wasted a
lot of time with X-Wing.

The common factor here is composite signatures and asymmetric encryption
being interop-critical, while key exchange can rely on algoirithm
agility. Destroing interoperability destroys security. So stand-alone
ML-KEM/ML-DSA is not that controversial.




-Ilari