Re: [CFRG] [EXTERNAL] Re: Streamlined NTRU Prime: sntrup761

[Mike Ounsworth <[e-mail]>]

Thanks for pointing this out Orie.

First, I’ve added these two drafts to the PQUIP list (well, it’s in a PR until @Paul Hoffman<mailto:[e-mail]> approves it).
https://github.com/ietf-wg-pquip/state-of-protocols-and-pqc


It first glance, this DOES NOT appear to be aligned with draft-ounsworth-cfrg-kem-combiners/.

First, your security considerations is not nearly long enough considering that taking two IND-CCA2 KEMs and preserving that property through a KEM combiner is not a straightforward topic (or one that even has consensus in the literature).

Second, you are proposing as the combiner: SHA512(K1||K2) – I assume that means SHA2-512?
I see two problems: 1)This will not be FIPS-certifiable under NIST SP-800 56Cr2, 2) it’s not clear that SHA2 behaves as a dual-PRF in the way you need for this construction to preserve IND-CCA2.


In draft-ounsworth-cfrg-kem-combiners, we are currently proposing the combiner (though this will probably get adjusted in the next rev)

KDF(counter || k_1 || ... || k_n || fixedInfo, outputBits)


where k_i = H(ss_i || ct_i)

and we’re only allowing SHA3 / KMAC for KDF and H because it’s more straightforward to argue that these behave as multi-PRFs (I think; Aron, Stavros, or Falko may correct me).

If you’re proposing the much weaker combiner SHA512(K1||K2), then I expect a lengthy security consideration explaining why the reduction in security is safe in your context.

Simon, I’d be happy to chat offline via email or phone call.

---
Mike Ounsworth
Software Security Architect, Entrust

From: CFRG <[e-mail]> On Behalf Of Orie Steele
Sent: Friday, May 12, 2023 7:22 AM
To: Simon Josefsson <simon=[e-mail]>
Cc: [e-mail]
Subject: [EXTERNAL] Re: [CFRG] Streamlined NTRU Prime: sntrup761

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.
________________________________
Is the hybrid approach taken inline with the kem combiners work, if not, is there a reason that would be interesting to discuss?

https://datatracker.ietf.org/doc/draft-ounsworth-cfrg-kem-combiners/<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-ounsworth-cfrg-kem-combiners/__;!!FJ-Y8qCqXTj2!YHUpiDUpJv3dzMs7TKQZrZejrhzVbNe60wSQXNpRiz1xMSmef2TqH17jnj2E0q0flSQa4eTRYWYdeL7SvDY_8lbIPOQ$>

The draft mentioned sntru has been widely implemented, can you comment on the adoption timeline?

It is good to see the test driver.

OS

On Thu, May 11, 2023, 5:20 PM Simon Josefsson <simon=[e-mail]<mailto:[e-mail]>> wrote:
Hi

I have published the following documents:

https://datatracker.ietf.org/doc/html/draft-josefsson-ntruprime-streamlined-00<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/html/draft-josefsson-ntruprime-streamlined-00__;!!FJ-Y8qCqXTj2!YHUpiDUpJv3dzMs7TKQZrZejrhzVbNe60wSQXNpRiz1xMSmef2TqH17jnj2E0q0flSQa4eTRYWYdeL7SvDY_Vu7CtWM$>
https://datatracker.ietf.org/doc/html/draft-josefsson-ntruprime-hybrid-00<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/html/draft-josefsson-ntruprime-hybrid-00__;!!FJ-Y8qCqXTj2!YHUpiDUpJv3dzMs7TKQZrZejrhzVbNe60wSQXNpRiz1xMSmef2TqH17jnj2E0q0flSQa4eTRYWYdeL7SvDY_yHlvKbc$>

What do you think?

If you want to contribute to the documents, they are maintained on
GitLab: https://gitlab.com/jas/ietf-ntruprime<https://urldefense.com/v3/__https:/gitlab.com/jas/ietf-ntruprime__;!!FJ-Y8qCqXTj2!YHUpiDUpJv3dzMs7TKQZrZejrhzVbNe60wSQXNpRiz1xMSmef2TqH17jnj2E0q0flSQa4eTRYWYdeL7SvDY__L_d8Es$>

/Simon
_______________________________________________
CFRG mailing list
[e-mail]<mailto:[e-mail]>
https://www.irtf.org/mailman/listinfo/cfrg<https://urldefense.com/v3/__https:/www.irtf.org/mailman/listinfo/cfrg__;!!FJ-Y8qCqXTj2!YHUpiDUpJv3dzMs7TKQZrZejrhzVbNe60wSQXNpRiz1xMSmef2TqH17jnj2E0q0flSQa4eTRYWYdeL7SvDY_h4TOPYE$>
Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.