[CFRG] Re: DHKEM binding properties

["D. J. Bernstein" <[e-mail]>]

Cas Cremers writes:
> Also, if we were to redesign KEMs with what we know now, we would
> probably only recommend explicitly rejecting KEMs.

Please clarify. Who's "we", what is the information that "we know now",
when did this information appear, and what is the evidence that "we
would probably" abandon implicit rejection given this information?

On a technical level, how does this information override (1) the fact
that various deployed post-quantum KEMs such as NTRU-HRSS would be
broken by fast chosen-ciphertext attacks if they abandoned implicit
rejection, and (2) the easy theorem that implicit rejection cannot have
lower IND-CCA2 security than explicit rejection does?

I'd appreciate an answer that avoids the new MALEFICENT-BINDS-VOLDEMORT
jargon. Any actual attack should be something that can be explained with
a convincing jargon-free example.

The reason I'm already confused by "we" is that the phrase "if we were
to redesign KEMs with what we know now" sounds like it's talking about
people who designed KEMs earlier, whereas other parts of the message
sound like they're talking about the authors of eprint 2023/1933.

---D. J. Bernstein