[CFRG] Re: RG Last Call on draft-irtf-cfrg-hybrid-kems-12 and draft-irtf-cfrg-concrete-hybrid-kems-04

[Rohan Mahy <[e-mail]>]

Hi,
I've read the two documents and find them generally easy to read and
unusually accessible for non-crypto experts. I support publication.

In MLS we will immediately use the 3 concrete hybrid KEMs. ML-KEM-768 +
X25519 is a great default. I have talked to a number of end users
(companies and governments) who use P-256 (a lot) or P-384 (a few), who
want to deploy a PQ/T hybrid and don't want to abandon their NIST curve
infrastructure. We will implement MLS ciphersuites with all three of
the concrete hybrid KEMs.

thanks,
-rohan


On Wed, Jul 8, 2026 at 12:27 PM Nick Sullivan <[e-mail]>
wrote:

> Dear CFRG,
>
> This message starts a two-week RG Last Call on two related documents. The
> last
> call ends on Wednesday July 22, 2026:
>
>   Hybrid PQ/T Key Encapsulation Mechanisms (generic constructions)
>   draft-irtf-cfrg-hybrid-kems-12
>   https://www.ietf.org/archive/id/draft-irtf-cfrg-hybrid-kems-12.html
>
>   Concrete Hybrid PQ/T Key Encapsulation Mechanisms
>   draft-irtf-cfrg-concrete-hybrid-kems-04
>
> https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html
>
> Both are intended as Informational RFCs. Please reply on-list with your
> position
> on each document: ready to publish as-is, ready with specific changes, or
> not
> ready, together with the technical reasons. This feedback will help the
> chairs
> judge whether the documents are ready for IRSG review and publication.
>
> The scope and approach of this work were settled when the group adopted it
> well
> over a year ago, and both drafts have developed on the list in the open
> since
> then. This last call is about whether the text is technically correct and
> complete, so please ground any objection in a specific problem with the
> documents. Detailed comments are best filed as issues on the repositories
> (https://github.com/cfrg/draft-irtf-cfrg-hybrid-kems,
> https://github.com/cfrg/draft-irtf-cfrg-concrete-hybrid-kems) positions
> belong
> here on the list.
>
> Both documents were reviewed by the CFRG Crypto Review Panel ahead of this
> last
> call. The reviews are on the CFRG and crypto-panel lists:
>
>   Thomas Pornin (NCC Group), 3 June 2026, reviewed the generic framework
> with a
>   focus on the constructions and reductions, and concluded that it
> describes a
>   secure construction, with editorial and technical comments now reflected
> in -12.
>
>   Virendra Kumar (Qualcomm), 8 June 2026, reviewed the generic framework
> for
>   clarity, with notational comments now reflected in -12.
>
>   Russ Housley (Vigil Security), 2 June 2026, reviewed both drafts and
> found the
>   constructions and instantiations as specified.
>
> The current revisions incorporate changes proposed by the panel's comments.
>
> Thank you,
> Nick, for the CFRG chairs
> _______________________________________________
> CFRG mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>