[CFRG] Re: I-D Action: draft-irtf-cfrg-kemeleon-02.txt

[Veitch Shannon <[e-mail]>]

Dear CFRG,

We've updated the Kemeleon draft to reflect feedback from Dan Harkins and further insights, in particular:

* We revised both the main non-rejecting encoding (Section 4) as well as the rejecting encoding (Section 5.1) to make outputs byte-aligned.

  @Dan, to answer your explicit question on output sizes being off: your numbers were correct, as outputs should indeed be byte-aligned.

* For the rejecting encoding (Section 5.1), this requires some minor helper functions to randomize/clear unused bits in the top byte.

* For the non-rejecting encoding, we can use an appropriate parameter t in the Elligator²-style redundant representation for byte alignment.
     We've opted for t = 76 in the draft, with the following rationale:
       - Fixing t avoids a tunable parameter, helping interoperability and avoiding that people set it wrongly (too small or not byte-aligned).
       - t=76 ensures byte alignment s.t. Kemeleon-encoded ML-KEM encapsulation keys have the _same size_ as regular ML-KEM public keys, possibly convenient for deployments.

   - The resulting distribution's distance from uniform is at most 2^-76  (modulo ML-LWE).  Importantly, this randomized representation step does _not_ rely on any computational assumptions, i.e., we get 2^-76 statistical distance independent of adversarial capabilities.

     For censorship avoidance usage, this seems to be fine.  (Corresponding to "after seeing 2^76 connections, an observer can distinguish with 50% advantage.)

     For PAKEs, we'd appreciate input, but our understanding is that this corresponds to a 2^-76 chance of distinguishing one password guess right from wrong.


We'd appreciate feedback on the list (or during Felix's presentation at IETF 126), thanks for your input!

Best regards,
Felix, Douglas, and Shannon

On 3 Jul 2026, at 14:29, [e-mail] wrote:

Internet-Draft draft-irtf-cfrg-kemeleon-02.txt is now available. It is a work
item of the Crypto Forum (CFRG) RG of the IRTF.

  Title:   Kemeleon Encodings
  Authors: Felix Günther
           Douglas Stebila
           Shannon Veitch
  Name:    draft-irtf-cfrg-kemeleon-02.txt
  Pages:   15
  Dates:   2026-07-03

Abstract:

  This document specifies Kemeleon encoding algorithms for encoding ML-
  KEM encapsulation keys and ciphertexts as random bytestrings.
  Kemeleon encodings provide obfuscation of encapsulation keys and
  ciphertexts, relying on module LWE assumptions.

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-irtf-cfrg-kemeleon/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-irtf-cfrg-kemeleon-02.html

A diff from the previous version is available at:
https://author-tools.ietf.org/iddiff?url2=draft-irtf-cfrg-kemeleon-02

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts


_______________________________________________
CFRG mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]