Re: [CFRG] Call for adoption: Hybrid KEM Combiners

I'm also support idea of CFRG working on KEM combiners.
Both X-Wing and generic combiner sounds useful to me at the moment.

Cheers,

-- 
Kris Kwiatkowski
Cryptography Dev

> On 6 Feb 2024, at 11:59, Bas Westerbaan <bas=40cloudflare.com@dmarc.ietf.org> wrote:
> 
> I support the CFRG working on a document that offers concrete guidance on fashioning bespoke hybrids: there is a clear demand, and good resources are currently lacking.
> 
> I do completely agree with Dan that we should not lose track of (at least our) main goal: to help move everyone to a PQ/T hybrid asap.
> 
> Somewhere this year, perhaps around June, NIST will publish the final standards for ML-KEM. That's the moment we should have a KEM ready to go — at least for the common cases. That's the goal of X-Wing.
> 
> Nick, I would like to hear from you if you think that timeline is realistic for the proposed document.
> 
> Best,
> 
>  Bas
> 
> 
> 
> On Wed, Jan 31, 2024 at 4:29 PM Nick Sullivan <nicholas.sullivan@gmail.com> wrote:
> Dear CFRG,
> 
> There has been a lot of discussion on the list over the last few weeks around the topic of hybrid KEMs, including discussion around the topic of where we should go as a group. There seems to be significant interest in this topic from around the IETF and in broader industry. We (the chairs) have decided to open up a research call for adoption for a topic in this area, described below.
> 
> The standard context for the group applies here as always: As part of the IRTF, the CFRG is a research group, producing research documents relevant to the IETF and broader community. The CFRG does not publish standards and does not dictate cryptographic choices to IETF working groups. CFRG documents often come with concrete specifications for parameterizations relevant to groups within the IETF. Recent examples of documents of this style resulting from topics adopted by the CFRG include RFC 9497 (OPRF) and RFC 9381 (VRF), which provide a thorough overview of the topic along with concrete parameterizations that can adopted by protocol designers.
> 
> The CFRG has a full docket of important ongoing work, so it’s important to ensure that any work the CFRG adopts at this point aligns with the charter by offering necessary guidance (for network security in general and for the IETF in particular) on the use of emerging mechanisms.
> 
> With that preamble done, this email starts a three-week call for the adoption of a work item within the CFRG to produce an informational document exploring how to safely combine KEMs. This document
> * Will use draft-ounsworth-cfrg-kem-combiners as a starting point for describing generic combiners
> * Will include an analysis of the non-generic combiner mechanisms for specific KEMs outlined in draft-connolly-cfrg-xwing-kem and other published works in the area
> * Will describe the security properties and trade-offs of various methods of combining KEMs
> * Will provide concrete instantiations of hybrid KEMs that are relevant to IETF protocols (potentially similar to X-Wing and Chempat-X), including pseudocode and test vectors
> 
> Please give your views on whether this should be adopted as a CFRG draft and whether you would be willing to work on this document and/or review it.
> 
> 
> Nick, Alexey, Stanislav
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://mailman.irtf.org/mailman/listinfo/cfrg
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://mailman.irtf.org/mailman/listinfo/cfrg