Subject: [CFRG] Fwd: Yet another interesting KEM combiner

From: Deirdre Connolly <[email-masked]>
Date: Wed, 21 Feb 2024 15:01:36 -0500

Apple just announced their PQ3 upgrade to iMessage, with long term
ML-KEM-1024 keys and occasionally ratcheting Kyber758 keys. They combine
them P-256 ECDH and possibly a root key in an interesting variant of HKDF:

https://security.apple.com/assets/files/Security_analysis_of_the_iMessage_PQ3_protocol_Stebila.pdf

Based on previous literature, one would probably reach for a concatenation
scheme that then is just shoved through HKDF in one go (for example in
PQXDH in Signal), vs this kind of chained variant. It seems like an
interesting approach and I am wondering if anyone has any more information
about why one would construct it this way (the benefits vs a simpler way)

Deirdre