[CFRG] Re: ML-KEM for HPKE: just use seeds

[Rohan Mahy <[e-mail]>]

Hi Dierdre,
Thanks very much for getting this out. My main technical concern is this
paragraph, which does not provide a clear mapping of ML-KEM size to its
KDF, and muddles cipher suite definition with KEM definition:

We use HKDF-SHA256 and HKDF-SHA512 as the HPKE KDFs and AES-128-GCM and
AES-256-GCM as the AEADs for ML-KEM-512, ML-KEM-768, and ML-KEM-1024.

Please define the specific KDF to use clearly in text or in a table. (I
think we can leave AEAD out of this.) I heard much talk of using ML-KEM-768
for the 128-bit and 192-bit security levels. Should we have 3 or 4
definitions for HPKE KEM?
ML-KEM-512 (SHA256) for ??
ML-KEM-768 (SHA256) for 128?
ML-KEM-768 (SHA384) for 192
ML-KEM-1024 (SHA512) for 256

Regarding the IANA registration section, it requests 0x0512, 0x0768, and
0x1024. Please don't. 0x0040, 0x0041, etc would be much better. Is NSecret
really only 32 for all three KEMs? I would have guessed these increased to
48 and 64.

I'll propose an editorial PR soon, but these are my only substantive issues.
Thanks,
-rohan