[CFRG] ML-KEM for HPKE: just use seeds

[Deirdre Connolly <[e-mail]>]

Hello CFRG, I have published a new-new version of 'ML-KEM for HPKE':

https://datatracker.ietf.org/doc/draft-connolly-cfrg-hpke-mlkem/02/

Previous versions used ML-KEM to craft an updated KDF out of HPKE's
subroutines to achieve similar binding properties to the default KEM for
HPKE, DHKEM. With the final publication of FIPS 203
<https://doi.org/10.6028/nist.fips.203>, we now have a better compromise:
the officially FIPS-compliant 64-byte seed format of ML-KEM keys. This
format gives us MAL-BIND-K-CT and LEAK-BIND-K-PK security
<https://eprint.iacr.org/2024/523.pdf> out of the box. This seems good
enough for most use cases (especially inside IETF so far) and so I have
updated my document to just say, 'use ML-KEM as it is, but you MUST use the
64-byte seed format for the keys', and that's it. Hopefully you can take a
look.

Thanks!
Deirdre


---------- Forwarded message ---------
From: <[e-mail]>
Date: Fri, Oct 11, 2024 at 1:06 PM
Subject: New Version Notification for draft-connolly-cfrg-hpke-mlkem-02.txt
To: Deirdre Connolly <[e-mail]>


A new version of Internet-Draft draft-connolly-cfrg-hpke-mlkem-02.txt has
been
successfully submitted by Deirdre Connolly and posted to the
IETF repository.

Name:     draft-connolly-cfrg-hpke-mlkem
Revision: 02
Title:    ML-KEM for HPKE
Date:     2024-10-11
Group:    Individual Submission
Pages:    7
URL:
https://www.ietf.org/archive/id/draft-connolly-cfrg-hpke-mlkem-02.txt
Status:   https://datatracker.ietf.org/doc/draft-connolly-cfrg-hpke-mlkem/
HTML:
https://www.ietf.org/archive/id/draft-connolly-cfrg-hpke-mlkem-02.html
HTMLized:
https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-hpke-mlkem
Diff:
https://author-tools.ietf.org/iddiff?url2=draft-connolly-cfrg-hpke-mlkem-02

Abstract:

   This memo defines ML-KEM-based ciphersuites for HPKE ([RFC9180]).
   ML-KEM is believed to be secure even against adversaries who possess
   a cryptographically-relevant quantum computer.



The IETF Secretariat