From: Mike Ounsworth <Mike.Ounsworth@entrust.com>
To: 'LAMPS' <spasm@ietf.org>, "cfrg@irtf.org" <cfrg@irtf.org>
Thread-Topic: Notes from NIST call about IETF hybrid KEMs and SP 800-227. Oct
 17, 2024
Thread-Index: Adsgxadin8TOfVzhTw2gOqSiGqrIhg==
Date: Thu, 17 Oct 2024 18:52:43 +0000
Message-ID: 
 <CH0PR11MB5739050ED1ECEE1E521328349F472@CH0PR11MB5739.namprd11.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 
 =?us-ascii?Q?oaHAYBbtsn9H8PJJ0ZuGlmZs+xRR2lKEuMSjPXBHgJyEWZncuYIf84C8uhfS?=
 =?us-ascii?Q?6rwmDSwd8gjcA5U05+UivF9hK4NfBSk14IrKXImU6AoKw3OMflm/gkiwPVU7?=
 =?us-ascii?Q?FPOQp+gGnCu2qgaM85HZl30r7eoiSXP5afWBsSMklSqAo1B9B2O8t6TC/Srq?=
 =?us-ascii?Q?nau6rOD4DvaIrd9gIdqCLpeMp9g/C0ByjfCM39ypCMW19D4W0qJqpdsEt1oC?=
 =?us-ascii?Q?E3iCpJVfJHQexTdnyAtt7NvEwjjGjBjB3/mHGO1LP96GMfcN9ew2tvKqzM0g?=
 =?us-ascii?Q?KJP4kFHPH4/d9T+SymUywb01Dh9jN7QyV0HNFvGMPTfnsWUPMlRdvuvALdFN?=
 =?us-ascii?Q?QeFPvv0Ap7F+3EifH+YLZTmZW3Tnyq789VNwWnWvjKOblQabq3b+9LNoSHHW?=
 =?us-ascii?Q?9FGQBOsztzuMABQCOAULnxAaLfd6TIxaG2xiSbEbz5LnasxdGb/dV2aHy/Yr?=
 =?us-ascii?Q?iB1PEhQW04X3H5flJ3OKCwEs9CMkteSmw7vHv7I3xrDWhsS1hqOIby+3KBH6?=
 =?us-ascii?Q?qbfxNOnCZF7KeHVkD3H+8ARK9gfTyx1rS0lp1d+cucFfNBRekmk8cVDjazPC?=
 =?us-ascii?Q?uw9prIUvAhuTTnWwQu5kJkZdbj4Szm4mvCgsx4zUaDP/rdmEsS//qjX1ZFq7?=
 =?us-ascii?Q?MYGVww1BWsynA0UgUJRCnQgnZD1lPi2lg42CtlUouGjqekv95AIEh4h2kdIu?=
 =?us-ascii?Q?JZeIu8dBOuezANC1mJr4hItr1wYAZdytkh0UOvJ0HHtMsaQSK23QQuQJBOgS?=
 =?us-ascii?Q?pRRq2BstjMoKtQACcap9KkxFenyVsc29lRdmVFUzDVZQ1XiS8ayECOEoKeLO?=
 =?us-ascii?Q?EU0zV3lFuNkDD3J94B/IMuAfciKcxE4QlNJVmAAPhDIytFxXgjtZS7b+RcwR?=
 =?us-ascii?Q?DLDbwx2vTI3XdZNDJu/PnyBPvkZNY6937RApZ6nEUW3m2BwWAaVyBVICqaxv?=
 =?us-ascii?Q?IT1LaTawwQgvL7XygMhPpOAIGceSgCAXMdALV+Bbx/Oi4d0zKKb/gd9LyZ28?=
 =?us-ascii?Q?LlzB4ZvKmLCe9Zwo6Bh2BoIO6RibcX+P/GcJ7TEZm0Xn2o0Q4wGKm3conZdn?=
 =?us-ascii?Q?2Gk5TOp9nAb4HrCyRiT9NR+oqRHLIb/01I5OH6Yp15ALoIfkojp1WSveMh+3?=
 =?us-ascii?Q?9kfrieHXiHMSxTEK/xPVq2zNBQXK2KOG3a84o2MY2OAGmiM6ta5bl3Cs9zPS?=
 =?us-ascii?Q?4mPD7tcypnBPazmAO9jzuO5q+FJqmR6ZloKc8Jf1Fif6/tLaVJT9ITYfcUGw?=
 =?us-ascii?Q?OO7IGS31GA7wR8DhUTXpeP1cIS4sXMuvtvahICSbEwP8PBdbWT5gGg0wvC3+?=
 =?us-ascii?Q?oaKXSJBirNG1NeTRTL65SANHbBoO6/o8HWRzzY/VYjIiJYH/McnPxRRw70u1?=
 =?us-ascii?Q?od/6p8KHsz9hsQJbUbiunml9RiLHweuV0wZ8dyji9hNPvGO4hb1zKVRh7EBc?=
 =?us-ascii?Q?3pgHTxw8UnoSMGSzzh7Qkt8wfhti1v/9mmnZAM8a1n7NFJ6SLNDmK79s7KfD?=
 =?us-ascii?Q?nGLcQYPf5T+1oKpEts7EW8F1PhwbBgkK1f6IO5wOHzgyigskdIotUZRiLTfK?=
 =?us-ascii?Q?owTiozOjYYnV0WCKntahdz5g01m89ii+SzNpS2xB?=
Content-Type: multipart/signed;
	protocol="application/x-pkcs7-signature";
	micalg=2.16.840.1.101.3.4.2.1;
	boundary="----=_NextPart_000_003B_01DB209B.D631A8C0"
MIME-Version: 1.0
X-OriginatorOrg: entrust.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CH0PR11MB5739.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 0937446c-b2a8-488b-6fa3-08dceedce255
X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Oct 2024 18:52:43.6945
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: f46cf439-27ef-4acf-a800-15072bb7ddc1
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 
 MhGZoJRzaIuseIksgcAFpARg1+X3TQRs8hAbGUgQU/xtO4mbmdRtjc038mkK/P5AjnRhxLOhAPu4us06K67SeqPw/uNBVZnXh4P4RZILU3E=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR11MB8492
X-Proofpoint-ORIG-GUID: HqxBwXyA5B8ulJgy-ovucDMsbPjuME2-
X-Proofpoint-GUID: HqxBwXyA5B8ulJgy-ovucDMsbPjuME2-
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1051,Hydra:6.0.680,FMLib:17.12.62.30
 definitions=2024-10-17_21,2024-10-17_01,2024-09-30_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0
 clxscore=1011 mlxlogscore=966
 impostorscore=0 mlxscore=0 lowpriorityscore=0 malwarescore=0 adultscore=0
 suspectscore=0 priorityscore=1501 phishscore=0 spamscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.21.0-2409260000
 definitions=main-2410170127
Message-ID-Hash: I43WJPNTKOK6IHER6KLQM4HULNWSYQVU
X-Message-ID-Hash: I43WJPNTKOK6IHER6KLQM4HULNWSYQVU
X-MailFrom: Mike.Ounsworth@entrust.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency;
 loop; banned-address; member-moderation; header-match-cfrg.irtf.org-0;
 nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size;
 news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: =?utf-8?q?=5BCFRG=5D_Notes_from_NIST_call_about_IETF_hybrid_KEMs_and_SP_800-?=
 =?utf-8?q?227=2E_Oct_17=2C_2024?=
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/cfrg/lMjb-LxUS5n1o93-kqvwRIIZ_44>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Owner: <mailto:cfrg-owner@irtf.org>
List-Post: <mailto:cfrg@irtf.org>
List-Subscribe: <mailto:cfrg-join@irtf.org>
List-Unsubscribe: <mailto:cfrg-leave@irtf.org>

------=_NextPart_000_003B_01DB209B.D631A8C0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_001_003C_01DB209B.D631A8C0"


------=_NextPart_001_003C_01DB209B.D631A8C0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Notes from NIST call about IETF hybrid KEMs and SP 800-227. Oct 17, 2024

========================================================================

 

I would like to consider three different (but similar) hybrid KEM combiner
constructions in IETF 

documents that are approaching publication.

 

The question for this meeting:

>>>> 

If these KEM combiners are implemented as-written, will they be able to
receive FIPS certification under SP 800-227?

Alternatively, can they already be certified under SP 800-56Cr2?

<<<< 

 

 

1.

https://datatracker.ietf.org/doc/html/draft-ietf-lamps-pq-composite-kem-04#n
ame-kem-combiner

 

This supports ML-KEM + X25519, ECDH, and RSA-OAEP

 

 

2.

The above is a very minor adjustment from

https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-xwing-kem-04#name-
combiner

 

This supports only ML-KEM768+X25519

 

 

3.

https://datatracker.ietf.org/doc/html/draft-wussler-openpgp-pqc-04#name-key-
combiner

 

 

Notes:

 

Mike Ounsworth gave an overview of the KEM combiners in the three IETF
drafts above.

 

Angela Robinson: The LAMPS and the OpenPGP seem to be aligned 56Cr2 because
the domain separators fit nicely because the CT, PK, domain_separator would
fit into the fixedInfo. X-Wing places the domain separator first, which
would be problematic with a 56Cr2 certification. 800-227 is really an
extension of 56Cr2 and does not (currently) make any major deviations.

 

Elaine Barker: In our current thinking is that the first component would
need to be the FIPS-approved one.

 

Mike Ounsworth: one of the design goals here is that implementors can start
using ML-KEM before receiving a FIPS certification for it by hybriding it
with an already-validated algorithm.

 

Turns out Brainpool is FIPS-approved? SP 800-186?

 

Russ: This order thing (that the FIPS-approved one needs to come first)
causes me concern because over time what is FIPS-approved will change (ex.:
at some point ECDH will be removed from the FIPS-approved list). It would be
unfortunate if at that point we need to re-do all these protocols and
deployed systems to swap the order of the inputs.

 

Gorjan: Moving on from the order discussion. We should also discuss that
X-Wing has the label first and the others have it last. And we should talk
about the choice of KDFs (HKDF-SHA2, SHA3, and KMAC are all used, are they
all FIPS-allowed?).

 

Deirdre: the X-Wing team did not consider FIPS certifiability when making
the construction, which is why we did not consider putting the label at the
end.

 

Gorjan asked if the X-Wing team would be willing to move the domain
separator to the end.

 

Chris Celi: FIPS 140-3 IG D.P. allows for dropping the counter in a
single-iteration case, so that may allow for the LAMPS HKDF-SHA2
construction to be certified (assuming the HKDF is ok).

 

Panos: HKDF is allowed specifically for TLS 1.3, there is a specific IG, but
HKDF is not FIPS-approved as a general KDF. SP 800-108, only HKDF-expand is
allowed as a generic KDF.

 

 

KDFs

 

Is HKDF-SHA2 FIPS compatible?

 

Want SHA2-nice options (SHA3 may not be available, KMAC 

 

https://words.filippo.io/dispatches/fips-hkdf/

"If you're doing key-agreement you can use HKDF per SP 800-56C Rev. 2. If
you're not you can use HKDF-Extract to combine a randomly-generated key with
other keys and/or data per SP 800-133 Rev. 2 (Section 6.3 Option #3), and
use HKDF-Expand as a general purpose KDF per SP 800-108.

 

SP 800-227 really really must say something about HKDF as a KDF not just for
key agreement.

HKDF is "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)" so it
is not a far stretch for it to be allowed under 56Cr2 Option 2: H(x) =
HMAC-hash(salt, x), but we need an IG from NIST that says this.

 

 

 

ACTION ITEMS:

- NIST : Is HKDF-SHA2 a sub-category of 56Cr2 Option 2 (HMAC-Hash)

- NIST : come up with a position on order of the KDF shared secret inputs
(ie must it be that the first one is the FIPS approved one). The community
has asked that 800-227 relax the requirement or order.

- X-Wing team : consider moving the label to the end.

 

---
Mike Ounsworth
Software Security Architect, Entrust

 


------=_NextPart_001_003C_01DB209B.D631A8C0
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	font-size:11.0pt;
	font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:#467886;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Aptos",sans-serif;
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:11.0pt;
	mso-ligatures:none;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US =
link=3D"#467886" vlink=3D"#96607D" style=3D'word-wrap:break-word'><div =
class=3DWordSection1><p class=3DMsoNormal>Notes from NIST call about =
IETF hybrid KEMs and SP 800-227. Oct 17, 2024<o:p></o:p></p><p =
class=3DMsoNormal>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D<o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal>I would like to consider three different (but similar) =
hybrid KEM combiner constructions in IETF <o:p></o:p></p><p =
class=3DMsoNormal>documents that are approaching =
publication.<o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal>The question for this meeting:<o:p></o:p></p><p =
class=3DMsoNormal>&gt;&gt;&gt;&gt;<o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal>If these KEM combiners are implemented as-written, =
will they be able to receive FIPS certification under SP =
800-227?<o:p></o:p></p><p class=3DMsoNormal>Alternatively, can they =
already be certified under SP 800-56Cr2?<o:p></o:p></p><p =
class=3DMsoNormal>&lt;&lt;&lt;&lt;<o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal>1.<o:p></o:p></p><p class=3DMsoNormal><a =
href=3D"https://datatracker.ietf.org/doc/html/draft-ietf-lamps-pq-composi=
te-kem-04#name-kem-combiner">https://datatracker.ietf.org/doc/html/draft-=
ietf-lamps-pq-composite-kem-04#name-kem-combiner</a><o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>This =
supports ML-KEM + X25519, ECDH, and RSA-OAEP<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal>2.<o:p></o:p></p><p class=3DMsoNormal>The above is a =
very minor adjustment from<o:p></o:p></p><p class=3DMsoNormal><a =
href=3D"https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-xwing-k=
em-04#name-combiner">https://datatracker.ietf.org/doc/html/draft-connolly=
-cfrg-xwing-kem-04#name-combiner</a><o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>This =
supports only ML-KEM768+X25519<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal>3.<o:p></o:p></p><p class=3DMsoNormal><a =
href=3D"https://datatracker.ietf.org/doc/html/draft-wussler-openpgp-pqc-0=
4#name-key-combiner">https://datatracker.ietf.org/doc/html/draft-wussler-=
openpgp-pqc-04#name-key-combiner</a><o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal>Notes:<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>Mike =
Ounsworth gave an overview of the KEM combiners in the three IETF drafts =
above.<o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal>Angela Robinson: The LAMPS and the OpenPGP seem to be =
aligned 56Cr2 because the domain separators fit nicely because the CT, =
PK, domain_separator would fit into the fixedInfo. X-Wing places the =
domain separator first, which would be problematic with a 56Cr2 =
certification. 800-227 is really an extension of 56Cr2 and does not =
(currently) make any major deviations.<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>Elaine =
Barker: In our current thinking is that the first component would need =
to be the FIPS-approved one.<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>Mike =
Ounsworth: one of the design goals here is that implementors can start =
using ML-KEM before receiving a FIPS certification for it by hybriding =
it with an already-validated algorithm.<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>Turns out =
Brainpool is FIPS-approved? SP 800-186?<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>Russ: This =
order thing (that the FIPS-approved one needs to come first) causes me =
concern because over time what is FIPS-approved will change (ex.: at =
some point ECDH will be removed from the FIPS-approved list). It would =
be unfortunate if at that point we need to re-do all these protocols and =
deployed systems to swap the order of the inputs.<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>Gorjan: =
Moving on from the order discussion. We should also discuss that X-Wing =
has the label first and the others have it last. And we should talk =
about the choice of KDFs (HKDF-SHA2, SHA3, and KMAC are all used, are =
they all FIPS-allowed?).<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>Deirdre: the =
X-Wing team did not consider FIPS certifiability when making the =
construction, which is why we did not consider putting the label at the =
end.<o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal>Gorjan asked if the X-Wing team would be willing to =
move the domain separator to the end.<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>Chris Celi: =
FIPS 140-3 IG D.P. allows for dropping the counter in a single-iteration =
case, so that may allow for the LAMPS HKDF-SHA2 construction to be =
certified (assuming the HKDF is ok).<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>Panos: HKDF =
is allowed specifically for TLS 1.3, there is a specific IG, but HKDF is =
not FIPS-approved as a general KDF. SP 800-108, only HKDF-expand is =
allowed as a generic KDF.<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal>KDFs<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>Is HKDF-SHA2 =
FIPS compatible?<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>Want =
SHA2-nice options (SHA3 may not be available, KMAC <o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><a =
href=3D"https://words.filippo.io/dispatches/fips-hkdf/">https://words.fil=
ippo.io/dispatches/fips-hkdf/</a><o:p></o:p></p><p =
class=3DMsoNormal>&quot;If you&#8217;re doing key-agreement you can use =
HKDF per SP 800-56C Rev. 2. If you&#8217;re not you can use HKDF-Extract =
to combine a randomly-generated key with other keys and/or data per SP =
800-133 Rev. 2 (Section 6.3 Option #3), and use HKDF-Expand as a general =
purpose KDF per SP 800-108.<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>SP 800-227 =
really really must say something about HKDF as a KDF not just for key =
agreement.<o:p></o:p></p><p class=3DMsoNormal>HKDF is &quot;HMAC-based =
Extract-and-Expand Key Derivation Function (HKDF)&quot; so it is not a =
far stretch for it to be allowed under 56Cr2 Option 2: H(x) =3D =
HMAC-hash(salt, x), but we need an IG from NIST that says =
this.<o:p></o:p></p><p class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>ACTION =
ITEMS:<o:p></o:p></p><p class=3DMsoNormal>- NIST : Is HKDF-SHA2 a =
sub-category of 56Cr2 Option 2 (HMAC-Hash)<o:p></o:p></p><p =
class=3DMsoNormal>- NIST : come up with a position on order of the KDF =
shared secret inputs (ie must it be that the first one is the FIPS =
approved one). The community has asked that 800-227 relax the =
requirement or order.<o:p></o:p></p><p class=3DMsoNormal>- X-Wing team : =
consider moving the label to the end.<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal>---<br>Mike =
Ounsworth<br>Software Security Architect, Entrust<o:p></o:p></p><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p></div></body></html>
------=_NextPart_001_003C_01DB209B.D631A8C0--

------=_NextPart_000_003B_01DB209B.D631A8C0
Content-Type: application/pkcs7-signature;
	name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
	filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCDn0w
ggQqMIIDEqADAgECAgQ4Y974MA0GCSqGSIb3DQEBBQUAMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5l
dDFAMD4GA1UECxQ3d3d3LmVudHJ1c3QubmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGlt
aXRzIGxpYWIuKTElMCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UE
AxMqRW50cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgpMB4XDTk5MTIyNDE3
NTA1MVoXDTI5MDcyNDE0MTUxMlowgbQxFDASBgNVBAoTC0VudHJ1c3QubmV0MUAwPgYDVQQLFDd3
d3cuZW50cnVzdC5uZXQvQ1BTXzIwNDggaW5jb3JwLiBieSByZWYuIChsaW1pdHMgbGlhYi4pMSUw
IwYDVQQLExwoYykgMTk5OSBFbnRydXN0Lm5ldCBMaW1pdGVkMTMwMQYDVQQDEypFbnRydXN0Lm5l
dCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAoMjA0OCkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQCtTUupEoay6qMgBxUWZCorS9G/C0pNju2AdqVnt3hAwHNCyGjA21Mr3V64dpg1k4sa
nXwTOg4fW7cez+UkFB6xgamNfbjMa0sD8QIM3KulQCQAf3SUoZ0IKbOIC/WHd51VzeTDftdqZKuF
FIaVW5cyUG89yLpmDOP8vbhJwXaJSRn9wKi9iaNnL8afvHEZYLgt6SzJkHZme5Tir3jWZVNdPNac
ss8pA/kvpFCy1EjOBTJViv2yZEwO5JgHddt/37kIVWCFMCn5e0ikaYbjNT8ehl16ehW97wCOFSJU
FwCQJpO8Dklokb/4R9OdlULBDk3fbybPwxghYmZDcNbVwAfhAgMBAAGjQjBAMA4GA1UdDwEB/wQE
AwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRV5IHREYC+2Im5CKMx+aEkCRa5cDANBgkq
hkiG9w0BAQUFAAOCAQEAO5uPVpsw51OZfHp5p02X1xmVkPsGH8ozfEZjj5ZmJPpAGyEnyuZyc/JP
/jGZ/cgMTGhTxoCCE5j6tq3aXT3xzm72FRGUggzuP5WvEasP1y/eHwOPVyweybuaGkSV6xhPph/N
fVcQL5sECVqEtW7YHTrh1p7RbHleeRwUxePQTJM7ZTzt3z2+puWVGsO1GcO9Xlu7/yPvaBnLEpMn
XAMtbzDQHrYarN5a99GqqCem/nmBxHmZM1e6ErCp4EJsk8pW3v5thAsIi36N6teYIcbz5zx5L16c
0UwVjeHsIjfMmkMLl9yAkI2zZ5tvSAgVVs+/8St8Xpp26VmQxXyDNRFlUTCCBRUwggP9oAMCAQIC
EQCvHASyrIz/mwAAAABRzhjjMA0GCSqGSIb3DQEBCwUAMIG0MRQwEgYDVQQKEwtFbnRydXN0Lm5l
dDFAMD4GA1UECxQ3d3d3LmVudHJ1c3QubmV0L0NQU18yMDQ4IGluY29ycC4gYnkgcmVmLiAobGlt
aXRzIGxpYWIuKTElMCMGA1UECxMcKGMpIDE5OTkgRW50cnVzdC5uZXQgTGltaXRlZDEzMDEGA1UE
AxMqRW50cnVzdC5uZXQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgKDIwNDgpMB4XDTIwMDcyOTE1
NDgzMFoXDTI5MDYyOTE2MTgzMFowgaUxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJ
bmMuMTkwNwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlzIGluY29ycG9yYXRlZCBieSByZWZl
cmVuY2UxHzAdBgNVBAsTFihjKSAyMDEwIEVudHJ1c3QsIEluYy4xIjAgBgNVBAMTGUVudHJ1c3Qg
Q2xhc3MgMiBDbGllbnQgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDEMo1C0J4Z
nVuQWhBMtRAAIbkHSN6uboDW/xRQBuh1r2tGjuelT63DjLD6e+AZkf3wY61xSfOoHB+rNBkgTktU
6QCTvnAIMd6JU6xXvCTvKo9C1PfqlSVdFHbSzacS+huytFxhQL1f3VebRFXYxYkZPGU9uejUpS3C
LNPqgzGiCDxeWa4SLioKjF7zszGuCq1+7LBJCfynLiIeaGQ0nRbjpj0DMUAW95T2Sxk0yZfmIpxI
3mSggwtYBZjEIkaJBf2jvvZJTGEDFqT4Cpkc4sDGfmkCMleQA68AlKG53M6v7/R8GM4wC8qH+NVf
H1lR2IsLuTjGWMJTfNom1NvyvZDNAgMBAAGjggEtMIIBKTAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0l
BBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMCMBIGA1UdEwEB/wQIMAYBAf8CAQAwMwYIKwYBBQUHAQEE
JzAlMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5lbnRydXN0Lm5ldDAyBgNVHR8EKzApMCegJaAj
hiFodHRwOi8vY3JsLmVudHJ1c3QubmV0LzIwNDhjYS5jcmwwOwYDVR0gBDQwMjAwBgRVHSAAMCgw
JgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuZW50cnVzdC5uZXQvcnBhMB0GA1UdDgQWBBQJkaW66fIu
KnXfzX7+d8ry3mubJDAfBgNVHSMEGDAWgBRV5IHREYC+2Im5CKMx+aEkCRa5cDANBgkqhkiG9w0B
AQsFAAOCAQEAP73pEHXzQqfRbIEmoUYgVxIkFVqyDAh/3Ue5P0KTpAqvTBHuzGsw9LQshN4KF5D5
eDSuriZFdgU1JIPAk3OZT6VycWO0CYgRy2xu75SV1Uk3z6EA8A1LFFFG9Ghxsv5goTcPJfzvIFoz
xqmHyepS9tdpSJbOWs8Qm/a3AcM6IaXIQ8CEnQP4xTQIh8uLCoNcqiMr6f+43qdJDm0yFYEwyCf0
wP7PGnXMh7u6EaGCZVAFn/NFkoegRbgZ51/4RgpbzNhdaxaRTBWVauPk/N4GdPZsVN3EJfBpFtbq
Dj9ZvgFi+WCfHUCzMfcQnC/5ikRm2GACTjEQsfaXjv4gg71NSjCCBTIwggQaoAMCAQICEGTNCNb8
1SJXAAAAAEw9ahkwDQYJKoZIhvcNAQELBQAwgaUxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRy
dXN0LCBJbmMuMTkwNwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlzIGluY29ycG9yYXRlZCBi
eSByZWZlcmVuY2UxHzAdBgNVBAsTFihjKSAyMDEwIEVudHJ1c3QsIEluYy4xIjAgBgNVBAMTGUVu
dHJ1c3QgQ2xhc3MgMiBDbGllbnQgQ0EwHhcNMjMxMTAxMTIwMTMzWhcNMjQxMjAxMTIzMTMyWjCB
ojELMAkGA1UEBhMCVVMxEjAQBgNVBAgTCU1pbm5lc290YTERMA8GA1UEBxMIU2hha29wZWUxEDAO
BgNVBAoTB0VudHJ1c3QxGDAWBgNVBGETD05UUlVTK0RFLTcwNTQyMTFAMBUGA1UEAxMOTWlrZSBP
dW5zd29ydGgwJwYJKoZIhvcNAQkBFhptaWtlLm91bnN3b3J0aEBlbnRydXN0LmNvbTCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAJdIuTWmpXIJEUB3PC/eqwlPmJSjiZKNNlS+5IguScxe
wHe5qBeMs6i1mD2LK3s9ICsj6KIyzdmmvVtPZ/TKfTcCV4s2E8+HG0Zaa0keCNz67fxMNElRtFTE
T2u4b/DusspFx9fGX+4e+zKUN+1I2EvmYXL3Wgd+mtQBSAp3AQW5M85lUQ+JYDyZNMg9dMUF5v1b
wz+FlT+C2ULWKu75ksngTzbKgEqXJqJUCN9kvoISIDy2CFUgUL/V8L6YjrgQ7/9WfjMeRnHC3Zgh
/i6MRmWyFUrnhXIwn/P0YvHnxii1XnPZq0rSI+OF0BKlQ0KWqGOeO0sHTApklnCXpMsFBWkCAwEA
AaOCAV0wggFZMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIw
FAYDVR0gBA0wCzAJBgdngQwBBQMBMGoGCCsGAQUFBwEBBF4wXDAjBggrBgEFBQcwAYYXaHR0cDov
L29jc3AuZW50cnVzdC5uZXQwNQYIKwYBBQUHMAKGKWh0dHA6Ly9haWEuZW50cnVzdC5uZXQvMjA0
OGNsYXNzMnNoYTIuY2VyMDQGA1UdHwQtMCswKaAnoCWGI2h0dHA6Ly9jcmwuZW50cnVzdC5uZXQv
Y2xhc3MyY2EuY3JsMCUGA1UdEQQeMByBGm1pa2Uub3Vuc3dvcnRoQGVudHJ1c3QuY29tMB8GA1Ud
IwQYMBaAFAmRpbrp8i4qdd/Nfv53yvLea5skMB0GA1UdDgQWBBQUF+o3pSgKSurXXXrsaYlITB7K
ZTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQAXcn31Eug0vqa4xs7DXYAoQ8S35ylgEXpi
ElFU5FcRzOlSN1EwIpqlGbGWUMGLbL1hFLH2EbtRAdK/bgyuX89pfeSAjbwJIvVffnkO7D1iMiRu
5vQrCK7ftDLGH3LoAbtjdqS9hex4KgHfFp+jO85JXp3GPcug3LL9q8SnEx0l9c9xkzPvtbFfTVwx
sLd/QjXehl00QGPce4S2kEtmyBl0MzUVnWOtk0GVC8fkqIIz5UkXBdXidISIuzmJqI1KRBhlChW4
gXyUgAO0R6ojH/pkVvzITx96idshXnzXuOXtTW25nivvWqx5wt7f3wfxNZQOMQ3xHOpDj1cOXyUN
XjhfMYIEhzCCBIMCAQEwgbowgaUxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMu
MTkwNwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlzIGluY29ycG9yYXRlZCBieSByZWZlcmVu
Y2UxHzAdBgNVBAsTFihjKSAyMDEwIEVudHJ1c3QsIEluYy4xIjAgBgNVBAMTGUVudHJ1c3QgQ2xh
c3MgMiBDbGllbnQgQ0ECEGTNCNb81SJXAAAAAEw9ahkwDQYJYIZIAWUDBAIBBQCgggKdMBgGCSqG
SIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI0MTAxNzE4NTI0MlowLwYJKoZI
hvcNAQkEMSIEIKFW5JOacEqmkHP7XrvW5/khowsIslQgsfhXcZBqmDhkMIGTBgkqhkiG9w0BCQ8x
gYUwgYIwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggqhkiG9w0DBzALBglghkgBZQMEAQIw
DgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAsGCWCGSAFlAwQCATALBglghkgBZQMEAgMw
CwYJYIZIAWUDBAICMAcGBSsOAwIaMIHLBgkrBgEEAYI3EAQxgb0wgbowgaUxCzAJBgNVBAYTAlVT
MRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMTkwNwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlz
IGluY29ycG9yYXRlZCBieSByZWZlcmVuY2UxHzAdBgNVBAsTFihjKSAyMDEwIEVudHJ1c3QsIElu
Yy4xIjAgBgNVBAMTGUVudHJ1c3QgQ2xhc3MgMiBDbGllbnQgQ0ECEGTNCNb81SJXAAAAAEw9ahkw
gc0GCyqGSIb3DQEJEAILMYG9oIG6MIGlMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwg
SW5jLjE5MDcGA1UECxMwd3d3LmVudHJ1c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkgcmVm
ZXJlbmNlMR8wHQYDVQQLExYoYykgMjAxMCBFbnRydXN0LCBJbmMuMSIwIAYDVQQDExlFbnRydXN0
IENsYXNzIDIgQ2xpZW50IENBAhBkzQjW/NUiVwAAAABMPWoZMA0GCSqGSIb3DQEBAQUABIIBAFfu
9rjgEQshpVMmqsS7SwDnBo/V/cfdfykQNjyY6EtekbDMyelBjl7WU2hC4JX3qYH/wyGVm7ABJxn7
lXR6Xt7xm3wDpFRkeRpcHBo2JMFabpDDtBR4UPyGFLpOn7wcsRLw98EFXZjrbDwQ1jlpFhs4Qbc7
TkEsMBcC6TqoTEkJGYb/ykP/HRuG6bC8Ibd+MC/FqgiW6k9MNs52956lKVupiLj08AYVHEZvUFh7
N7UkzlAOKkWDSo3qxCScpwA5f/t/t0xiqhdpwarDKyTBzyByuD6l5fx85E/2oYmlR/YajfQuOTuI
LSxBDizcTsbxAPd+uS35tASDW9h1LC50qjIAAAAAAAA=

------=_NextPart_000_003B_01DB209B.D631A8C0--