Re: [CFRG] Chempat: Generic Instantiated PQ/T Hybrid Key Encapsulation Mechanisms

I hope to see this move forward as I believe that a few open source
projects will definitely consider this. Ideally, this would be merged with
other work but It appears that we are heading towards multiple standards ?

On Sun, 18 Feb 2024 at 14:41, Simon Josefsson
<simon=40josefsson.org@dmarc.ietf.org> wrote:
>
> Hi
>
> Having had some time to reflect on the following documents, I find a lot
> that I like in each of them, but I find there are important elements
> missing in each before we have a healthy Hybrid KEM ecosystem.
>
> https://datatracker.ietf.org/doc/html/draft-ounsworth-cfrg-kem-combiners-05
> https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-xwing-kem-01
> https://datatracker.ietf.org/doc/html/draft-cfrg-schwabe-kyber-02
> https://datatracker.ietf.org/doc/html/draft-josefsson-ntruprime-hybrid-01
>
> Rather than trying to suggest improvements to each of the documents, I
> collected my preferred approach in a new proposal:
>
> https://datatracker.ietf.org/doc/html/draft-josefsson-chempat-00
>
> tl;dr: SHA3-256(ss_DHKEM ss_PQKEM SHA3-256(ct_DHKEM | ct_PQKEM) SHA3-256(pk_DHKEM | pk_PQKEM) ctx)
>
> One of the purpose with Chempat to satisfy the following two ideas, that
> I found lacking in the proposals above:
>
> 1) Provide a re-usable pattern for a Hybrid KEM that is amenable to
> security reasoning with lower complexity.
>
> 2) Provide instantiated algorithms that can be used drop-in for
> protocols and implementations.
>
> I am aware that there are several subtle details not explained by the
> draft, but I found the overall general design more important than the
> details.  If someone wants to help work on this, that would be great, or
> if some other effort wants to broaden its scope to cover the same goals,
> that would also be good.
>
> What do you think?
>
> /Simon
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://mailman.irtf.org/mailman/listinfo/cfrg