[CFRG] FW: [EXTERNAL] New Version Notification for draft-ounsworth-cfrg-kem-combiners-00.txt

[Mike Ounsworth <[e-mail]>]

Hi CFRG!

How to combine the output of two KEMs into a single shared secret is coming up in a bunch of places: 1. anywhere that's doing KEM/PSK hybrids 2. anywhere that’s doing Post-Quantum / Traditional hybrid KEMs (TLS, CMS, OpenPGP, JOSE/COSE, etc), and 3. anywhere that’s trying to replace a static-static DH with KEMs needs to do a KEM in each direction and combine them (see my recent thread “How will Kyber be added to HPKE?”).

At TLS 113, Douglas Stebila presented draft-ietf-tls-hybrid-design and a discussion ensued about whether KDF( ss1 || ss2 ) is a sound choice of combiner with Stebila saying “It’s fine” and Nimrod Aviram saying “But we could do better with a real Dual PRF!”. As far as I know, this debate is unresolved, so I think we need to document the standard way of doing this with any applicable caveats because people *are* doing this. This draft hopefully is not groundbreaking, just giving us something to point at so we’re all doing it the same way.

Disclaimer: I am not a cryptographer. I would love critique (I’m willing to offer co-authorship) to tighten up the security analysis and the statements about where this construction is and is not safe to use.


---
Mike Ounsworth

-----Original Message-----
From: [e-mail] <[e-mail]>
Sent: November 25, 2022 8:21 PM
To: Mike Ounsworth <[e-mail]>
Subject: [EXTERNAL] New Version Notification for draft-ounsworth-cfrg-kem-combiners-00.txt

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________

A new version of I-D, draft-ounsworth-cfrg-kem-combiners-00.txt
has been successfully submitted by Mike Ounsworth and posted to the IETF repository.

Name:           draft-ounsworth-cfrg-kem-combiners
Revision:       00
Title:          Combiner function for hybrid key encapsulation mechanisms (Hybrid KEMs)
Document date:  2022-11-25
Group:          Individual Submission
Pages:          14
URL:            https://urldefense.com/v3/__https://www.ietf.org/archive/id/draft-ounsworth-cfrg-kem-combiners-00.txt__;!!FJ-Y8qCqXTj2!aPvv_rJks1wNuj0CCg60vTBx5sKodPpctz4m4qHmeEIw9ZGQiX7UPrkt6DOYBe5GmsAjyimBoUGZ2j0NzeCyjHPM6QP7PQ$
Status:         https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-ounsworth-cfrg-kem-combiners/__;!!FJ-Y8qCqXTj2!aPvv_rJks1wNuj0CCg60vTBx5sKodPpctz4m4qHmeEIw9ZGQiX7UPrkt6DOYBe5GmsAjyimBoUGZ2j0NzeCyjHPnNK1zOA$
Htmlized:       https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/draft-ounsworth-cfrg-kem-combiners__;!!FJ-Y8qCqXTj2!aPvv_rJks1wNuj0CCg60vTBx5sKodPpctz4m4qHmeEIw9ZGQiX7UPrkt6DOYBe5GmsAjyimBoUGZ2j0NzeCyjHP6-WELQQ$


Abstract:
   The migration to post-quantum cryptography often calls for performing
   multiple key encapsulations in parallel and then combining their
   outputs to derive a single shared secret.

   This document defines the KEM combiner KDF( H(ss1) || H(ss2) ) which
   is considered to be a dual PRF in practice, even though not provably
   secure.  This mechanism simplifies to KDF( ss1 || ss2 ) when used
   with a KEM which internally uses a KDF to produce its shared secret.
   RSA-KEM, ECDH, Edwards curve DH, and CRYSTALS-Kyber are shown to meet
   this criteria and therefore be safe to use with the simplified KEM
   combiner.




The IETF Secretariat


Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.