MIME-Version: 1.0
References: 
 <CAN8C-_LqcWy=d=6KkVCwfOs28nZugzbTjHYPNOAchs5E_EWHiw@mail.gmail.com>
 <CAMjbhoVE+44ZnOB4s3Vk3MF26w7gWaodU0AmP9YO6utXZX5_1g@mail.gmail.com>
 <CAN8C-_KGXmBJqYvu2RW6U5TAvVEp_3z+XkMCjeAwPcKNFO1saA@mail.gmail.com>
In-Reply-To: 
 <CAN8C-_KGXmBJqYvu2RW6U5TAvVEp_3z+XkMCjeAwPcKNFO1saA@mail.gmail.com>
From: Bas Westerbaan <bas@cloudflare.com>
Date: Tue, 28 May 2024 16:27:29 +0200
Message-ID: 
 <CAMjbhoUHidtvgGyL_GZ=gA9bAYPub4z8QKSVUj9-K=kBcXm6Rg@mail.gmail.com>
To: Orie Steele <orie@transmute.industries>
Content-Type: multipart/alternative; boundary="000000000000b14ba80619846f8a"
Message-ID-Hash: PMI7NGBA256TQ7GNZZUMZX4736AYWBMQ
CC: CFRG <cfrg@irtf.org>,
 Deirdre Connolly <deirdre.connolly@sandboxquantum.com>
Precedence: list
Subject: =?utf-8?q?=5BCFRG=5D_Re=3A_PQ_HPKE_in_JOSE_and_COSE_with_ML-KEM-768=2C_HKDF-?=
	=?utf-8?q?SHA256=2C_AES128GCM?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/cfrg/b8aLlMMbHR-UkxnQgCb4QWi-9b0>

--000000000000b14ba80619846f8a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, May 28, 2024 at 4:19=E2=80=AFPM Orie Steele <orie@transmute.industr=
ies>
wrote:

> If I'm reading the pqc-forum correctly, the domain separation applies to
> KeyGen only (which is before HPKE).
>

A HPKE KEM needs to define a DeriveKeyPair(ikm) function. GenerateKeyPair
is typically implemented as just calling DeriveKeyPair on a random seed.

See the "ikmR" values in the test vectors of

https://datatracker.ietf.org/doc/rfc9180/
https://datatracker.ietf.org/doc/draft-westerbaan-cfrg-hpke-xyber768d00/

Also we would be assuming there is not any other backwards incompatible
change to ML-KEM.



> Or are you suggesting there will be HPKE ML-KEM domain separation from
> regular ML-KEM?
>

No. [1]


> I'm mostly interested in what parts of HPKE ML-KEM will change, assuming
> ML-KEM is a black box that will eventually become immutable.
>

That's up to NIST.

Best,

 Bas

--000000000000b14ba80619846f8a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote">=
<div dir=3D"ltr" class=3D"gmail_attr">On Tue, May 28, 2024 at 4:19=E2=80=AF=
PM Orie Steele &lt;orie@transmute.industries&gt; wrote:<br></div><blockquot=
e class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px s=
olid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">If I&#39;m reading=
 the pqc-forum correctly, the domain separation=C2=A0applies to KeyGen only=
 (which is before HPKE).<br></div></blockquote><div><br></div><div>A HPKE K=
EM needs to define a DeriveKeyPair(ikm) function. GenerateKeyPair is typica=
lly implemented as just calling DeriveKeyPair on a random seed.</div><div><=
br></div><div>See the &quot;ikmR&quot; values in the test vectors of</div><=
div><br></div><div><a href=3D"https://datatracker.ietf.org/doc/rfc9180/">ht=
tps://datatracker.ietf.org/doc/rfc9180/</a><br></div><div><a href=3D"https:=
//datatracker.ietf.org/doc/draft-westerbaan-cfrg-hpke-xyber768d00/">https:/=
/datatracker.ietf.org/doc/draft-westerbaan-cfrg-hpke-xyber768d00/</a><br></=
div><div><br></div><div>Also we would be assuming there is not any other ba=
ckwards incompatible change to ML-KEM.</div><div><br></div><div>=C2=A0</div=
><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border=
-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">Or are =
you suggesting there will be HPKE ML-KEM domain separation=C2=A0from regula=
r ML-KEM?<br></div></blockquote><div><br></div><div>No. [1]</div><div>=C2=
=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8e=
x;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"=
>I&#39;m mostly interested in what parts of HPKE ML-KEM will change, assumi=
ng ML-KEM is a black box that will eventually become immutable.<br></div></=
blockquote><div><br></div><div>That&#39;s up to NIST.</div><div><br></div><=
div>Best,</div><div><br></div><div>=C2=A0Bas</div></div></div>

--000000000000b14ba80619846f8a--