[CFRG] Re: ML-KEM for HPKE: just use seeds

[John Mattsson <[e-mail]>]

I think it would be good if the draft registered KMAC based KDFs. While HMAC-SHA-2 could make sense in a transition period, it does not make sense to force future implementations to support both SHA-2 and SHA-3. ML-KEM uses SHA-3 internally so any implementation of ML-KEM has an implementation of SHA-3.

Cheers,
John

From: Deirdre Connolly <[e-mail]>
Date: Friday, 11 October 2024 at 19:20
To: CFRG <[e-mail]>
Subject: [CFRG] ML-KEM for HPKE: just use seeds
Hello CFRG, I have published a new-new version of 'ML-KEM for HPKE':

https://datatracker.ietf.org/doc/draft-connolly-cfrg-hpke-mlkem/02/

Previous versions used ML-KEM to craft an updated KDF out of HPKE's subroutines to achieve similar binding properties to the default KEM for HPKE, DHKEM. With the final publication of FIPS 203<https://doi.org/10.6028/nist.fips.203>, we now have a better compromise: the officially FIPS-compliant 64-byte seed format of ML-KEM keys. This format gives us MAL-BIND-K-CT and LEAK-BIND-K-PK security<https://eprint.iacr.org/2024/523.pdf> out of the box. This seems good enough for most use cases (especially inside IETF so far) and so I have updated my document to just say, 'use ML-KEM as it is, but you MUST use the 64-byte seed format for the keys', and that's it. Hopefully you can take a look.

Thanks!
Deirdre


---------- Forwarded message ---------
From: <[e-mail]<mailto:[e-mail]>>
Date: Fri, Oct 11, 2024 at 1:06 PM
Subject: New Version Notification for draft-connolly-cfrg-hpke-mlkem-02.txt
To: Deirdre Connolly <[e-mail]<mailto:[e-mail]>>


A new version of Internet-Draft draft-connolly-cfrg-hpke-mlkem-02.txt has been
successfully submitted by Deirdre Connolly and posted to the
IETF repository.

Name:     draft-connolly-cfrg-hpke-mlkem
Revision: 02
Title:    ML-KEM for HPKE
Date:     2024-10-11
Group:    Individual Submission
Pages:    7
URL:      https://www.ietf.org/archive/id/draft-connolly-cfrg-hpke-mlkem-02.txt
Status:   https://datatracker.ietf.org/doc/draft-connolly-cfrg-hpke-mlkem/
HTML:     https://www.ietf.org/archive/id/draft-connolly-cfrg-hpke-mlkem-02.html
HTMLized: https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-hpke-mlkem
Diff:     https://author-tools.ietf.org/iddiff?url2=draft-connolly-cfrg-hpke-mlkem-02

Abstract:

   This memo defines ML-KEM-based ciphersuites for HPKE ([RFC9180]).
   ML-KEM is believed to be secure even against adversaries who possess
   a cryptographically-relevant quantum computer.



The IETF Secretariat