[CFRG] Re: PQ HPKE in JOSE and COSE with ML-KEM-768, HKDF-SHA256, AES128GCM

[Bas Westerbaan <[e-mail]>]

Some replies inline.

I based my HPKE KEM implementation on ML-KEM-768 in
> https://github.com/paulmillr/noble-post-quantum
>

A word of caution that this implementation is not constant time. (It's very
difficult in javascript anyway, but a warning is in place.)


> This meant I needed to address both the HPKE and COSE / JOSE related
> context issues myself.
> It was not obvious to me exactly how to do this.
> Especially since there is no registry entries for ML-KEM in:
> https://www.iana.org/assignments/hpke/hpke.xhtml
> The answer appears to be in this draft:
> https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-hpke-mlkem-00#name-encap-and-decap
> I've done my best to follow the draft, in my experimental implementation.
>
> Are there implementations of HPKE out there using kem id 0x0070?
>
> Are we waiting on some final confirmation from NIST to add 0x0070 to
> https://www.iana.org/assignments/hpke/hpke.xhtml ?
> I can understand not wanting to burn a code point.
>

ML-KEM is not final yet. What people call ML-KEM now is typically the
"ipd", the initial public draft. HPKE KEMs test vectors typically include
deterministic key generation, and it seems likely [1]  that that will
change for the final version of ML-KEM.

Best,

 Bas

[1]
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/5CT4NC_6zRI/m/KyFx0sapAgAJ