Re: [CFRG] Kyber 'interactive key agreement'?

Hi Philip,

The most common situations I've found where KEMs don't work as a drop-in
for DH are when you want to do some authentication scheme.

For example, consider the OPTLS/draft-tls-semistatic proposals. In OPTLS,
the client sends over a g^x as usual, but the server takes that public key
and directly combines it with its long-term DH secret s to compute g^{xs}
(which OPTLS uses to compute a MAC). That's precisely the DH operation that
KEMs don't give you. To do OPTLS with KEMs, you need an extra round-trip:
the client needs to first receive the long-term KEM secret before it can
send back an encapsulation.[1] KEMTLS/draft-celi-wiggers-tls-authkem uses
some tricks to do basically that, but avoid the round-trip.

Ephemeral KEM key exchange in TLS (1.3) doesn't have this problem, because
authentication is done via signature. Plain old signatures are generally
non-interactive (putting all of the additional PQ signatures baggage aside).

DH is amazingly symmetric in its operations, and it seems to be turning out
that this property was a big gift.

In some discussions with Trevor Perrin about Noise protocols it seemed that
there are two obvious ways out of this mess (at least for Noise protocols):
an extra round-trip, or adding signatures. Of course, adding either to a
protocol that did not have them is kind of a bummer.

Cheers,

Thom

[1]: This was first discussed, as far as we're aware of, in the master's
thesis of Wouter Kuhnen (OPTLS revisited, section 6.2)
http://www.ru.nl/publish/pages/769526/thesis-final.pdf

Op di 2 aug. 2022 om 19:58 schreef Bas Westerbaan <bas=
40cloudflare.com@dmarc.ietf.org>:

> This might not look like it is a drop in replacement for ECDH,
>>
>
> It is not. But for TLS it is sufficient: client generates a keypair and
> sends pk. Server encapsulates for that pk and returns the created
> ciphertext.
>
>
>> [These routines call indcpa_enc, indcpa_dec which have rather different
>> signatures. But the external interface is drop-in as far as I can see.]
>>
>
> Don't use those.
>
>
>> I did a search on 'malleability' in the Kyber paper and found nothing. So
>> perhaps a clarification of the terms.
>>
>
> The term you want to search for is IND-CCA2.
>
> Best,
>
>  Bas
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>