IETF Logo Mail Archive

Re: [CFRG] Proposed CFRG hybrid KEM scope (was: "Millions of dollars of hashing")

Bas Westerbaan <bas@cloudflare.com> Sat, 24 February 2024 11:09 UTC

Return-Path: <bas@cloudflare.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 538BFC151071 for <cfrg@ietfa.amsl.com>; Sat, 24 Feb 2024 03:09:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.104
X-Spam-Level:
X-Spam-Status: No, score=-2.104 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=cloudflare.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EHyhfCjrwsli for <cfrg@ietfa.amsl.com>; Sat, 24 Feb 2024 03:09:02 -0800 (PST)
Received: from mail-ed1-x529.google.com (mail-ed1-x529.google.com [IPv6:2a00:1450:4864:20::529]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98F99C14F712 for <cfrg@irtf.org>; Sat, 24 Feb 2024 03:09:02 -0800 (PST)
Received: by mail-ed1-x529.google.com with SMTP id 4fb4d7f45d1cf-564372fb762so2277116a12.0 for <cfrg@irtf.org>; Sat, 24 Feb 2024 03:09:02 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1708772940; x=1709377740; darn=irtf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=Z1JCqIf08tuLFCJ4IoZQGHeqSv6UEYamGEJQy4l0GNc=; b=Js+05M14YJXxNxbrmA28t15Nis1jJ3Xnu8p21qxBF5D7i/U2WTUmR5ttEjl3oES98o zP0oLLEIfHCDy7ONbAOcQ1jlCVcXrEo+y3z6nLRVH2n1dYNBFz+uOgdOzV9mlvPi578K DQQ58Jj0UGYfDjXuh+t3SY3Y/YIwDw9jFwv6DDB6edkhwDgHlgtV4cEtgebQPlLpKf4F YY1/ACfPbB0nB1jv7sy91mMWkb+twE994cvii9O9LTNWd9pIBfNnn2Yab5XtZq+xkJcj nT4+ldVf4rJ9dUagZ8XcoNahiSuXCfYxlXtTEGtZS018celAZ8QMK+Y7oQ2h/byPx6Z9 dnuA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1708772940; x=1709377740; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Z1JCqIf08tuLFCJ4IoZQGHeqSv6UEYamGEJQy4l0GNc=; b=wk/g/1fznmpn+ZvxCTBCeUy/iyQEgILoaqvodBV1nJjDywCwMXtfyobaP//8X/hxCs 2NTlvhBWyyQO6S7EOkuMw8mk0ayDxOw/ULNJkvBVJGh/6ji4E00fmOhUvZmzKPIuoOlQ FEhpd1CFdF5TrQUU4INosrkjZwrRXZ5ngsKUrncbm8DPIH2j/YENqg6Dz0i4Ti4/W7PE 87l/8u42e6KUWW6zb36ZhGTqrpXriZwMMxw9DsXws+rwJr+Xzxs6loxYd15FQ7DHWWpJ Vz9G42uhEXQaWWQdycA2spRjr9EthacjBsXcrsyZyNeHC7QIDPRCw0W0Bo7murxF9G0h KoHw==
X-Gm-Message-State: AOJu0YwtZcXWDADuevsJq77ZuvFMLsa8z8O1tRjO75YjNPK4hjrubueW YJLWh4+SoILi7b8sShM+j8JP9SNNxo34wvFCCM1w0yDhYy9aIipSIjPGk0Gx/6rFdDoS1CoDC+o d1OWZm4D/raPnno3oxJaCWjL4QTMR48GmXThxZw==
X-Google-Smtp-Source: AGHT+IGE3ad29WIHvn46fVn3IbT7VgOf7arcoeOZyUf4necX0ylsTjUz8x7znlmC5bwICIZqNfMLK7eDHb/NBdmaayQ=
X-Received: by 2002:aa7:cf09:0:b0:565:6c31:9ab4 with SMTP id a9-20020aa7cf09000000b005656c319ab4mr1461911edy.31.1708772940168; Sat, 24 Feb 2024 03:09:00 -0800 (PST)
MIME-Version: 1.0
References: <CAEEbLAbRHjJGm-3CQipzW=n40B-b23D6ZxmHN-f3PtVikj5=Cw@mail.gmail.com> <20240222152700.929016.qmail@cr.yp.to> <CAMjbhoUpK7F-H3vqXZbHYpr0S6a_fZrUeoL2SDB6QLp9URL4GA@mail.gmail.com> <CAEEbLAbcJfLwXusFuPN+yaAbSA+ANd_vjhVzSOF5EP4gh2y+3A@mail.gmail.com> <CH0PR11MB5739F5E7010B2A99CF2BD9B09F562@CH0PR11MB5739.namprd11.prod.outlook.com> <Zdiufjr2pjcoSNhT@LK-Perkele-VII2.locald> <CAMjbhoVK1_p++RYftdXKaeLy9xQxr4igNhygYJ8exsZYQU8cig@mail.gmail.com> <ZdjHDTJKGPLyqv7s@LK-Perkele-VII2.locald>
In-Reply-To: <ZdjHDTJKGPLyqv7s@LK-Perkele-VII2.locald>
From: Bas Westerbaan <bas@cloudflare.com>
Date: Sat, 24 Feb 2024 12:08:49 +0100
Message-ID: <CAMjbhoXz5mFDyzOwSBqfcqFWfWNXiTVyC_ff7pzPJ8wrHnmOjA@mail.gmail.com>
To: Ilari Liusvaara <ilariliusvaara@welho.com>
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Content-Type: multipart/alternative; boundary="0000000000001a487506121eb49d"
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/q9lO_ZY1IjTbatdHVO2T4le745M>
Subject: Re: [CFRG] Proposed CFRG hybrid KEM scope (was: "Millions of dollars of hashing")
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://mailman.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://mailman.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Sat, 24 Feb 2024 11:09:06 -0000

On Fri, Feb 23, 2024 at 5:26 PM Ilari Liusvaara <ilariliusvaara@welho.com>
wrote:

> On Fri, Feb 23, 2024 at 03:46:28PM +0100, Bas Westerbaan wrote:
> > >
> > > Not quite zero tho, For ML-KEM-768+X25519, it is one Keccak-F versus
> > > one extra SHA-256 compress. The latter turns out to be a bit cheaper.
> > >
> >
> > What do you have in mind? X-Wing is just one keccak-F.
>
> Right, ending up with 32 byte shared secret.
>
> And draft-ietf-tls-hybrid-design ends up with 64 byte shared secret.
>
> Handling 64 byte shared secret needs one more SHA-256 compress call
> compared to handling 32 byte shared secret (it is no extra cost if
> using SHA-384 tho).
>

Ah, yes, of course. I misread your initial email. My bad.

v2.46.0 | Report a Bug | By Email | System Status