Re: [CFRG] [EXTERNAL] Re: Streamlined NTRU Prime: sntrup761

[Peter C <[e-mail]>]

Mike,

> It first glance, this DOES NOT appear to be aligned with
> draft-ounsworth-cfrg-kem-combiners/. 
>
> First, your security considerations is not nearly long
> enough considering that taking two IND-CCA2 KEMs
> and preserving that property through a KEM combiner
> is not a straightforward topic (or one that even has
> consensus in the literature).

As described, the sntrup761+x25519 hybrid KEM will not be IND-CCA secure.

For any hybrid ciphertext C = (C1, C2) it is easy to compute an equivalent ciphertext C' = (C1', C2) that encapsulates the same shared secret K = H(K1 || K2) by simply adding a small order point to the X25519 ciphertext component C1.  (This is the equivalent public key warning from the RFC 7748 security considerations.)  One call to the decapsulation oracle recovers the shared secret.

> Second, you are proposing as the combiner:
> SHA512(K1||K2) - I assume that means SHA2-512?
> 
> I see two problems: 1)This will not be FIPS-certifiable
> under NIST SP-800 56Cr2, 2) it's not clear that SHA2
> behaves as a dual-PRF in the way you need for this
> construction to preserve IND-CCA2.

To be absolutely clear, the sntrup761+x25519 hybrid construction is less secure than using sntrup761 by itself, regardless of any assumptions made about the hash function.

Best,

Peter

Peter Campbell
Industry Liaison and International Standards
[e-mail]