MIME-Version: 1.0
From: Deirdre Connolly <durumcrustulum@gmail.com>
Date: Fri, 11 Oct 2024 13:18:27 -0400
Message-ID: 
 <CAFR824xpwetkdZZL29TZoa2pEE6Ke537eNuritKbBJZ0wiCKYQ@mail.gmail.com>
To: CFRG <cfrg@irtf.org>
Content-Type: multipart/alternative; boundary="00000000000013b275062436afe8"
Message-ID-Hash: GGLWXIB5VJZDHQ6VI45SJ75KCZGFSTPW
Precedence: list
Subject: =?utf-8?q?=5BCFRG=5D_ML-KEM_for_HPKE=3A_just_use_seeds?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/cfrg/vdN-H0XUKXHgjN4Tuo7DkUU8VQ4>

--00000000000013b275062436afe8
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello CFRG, I have published a new-new version of 'ML-KEM for HPKE':

https://datatracker.ietf.org/doc/draft-connolly-cfrg-hpke-mlkem/02/

Previous versions used ML-KEM to craft an updated KDF out of HPKE's
subroutines to achieve similar binding properties to the default KEM for
HPKE, DHKEM. With the final publication of FIPS 203
<https://doi.org/10.6028/nist.fips.203>, we now have a better compromise:
the officially FIPS-compliant 64-byte seed format of ML-KEM keys. This
format gives us MAL-BIND-K-CT and LEAK-BIND-K-PK security
<https://eprint.iacr.org/2024/523.pdf> out of the box. This seems good
enough for most use cases (especially inside IETF so far) and so I have
updated my document to just say, 'use ML-KEM as it is, but you MUST use the
64-byte seed format for the keys', and that's it. Hopefully you can take a
look.

Thanks!
Deirdre


---------- Forwarded message ---------
From: <internet-drafts@ietf.org>
Date: Fri, Oct 11, 2024 at 1:06=E2=80=AFPM
Subject: New Version Notification for draft-connolly-cfrg-hpke-mlkem-02.txt
To: Deirdre Connolly <durumcrustulum@gmail.com>


A new version of Internet-Draft draft-connolly-cfrg-hpke-mlkem-02.txt has
been
successfully submitted by Deirdre Connolly and posted to the
IETF repository.

Name:     draft-connolly-cfrg-hpke-mlkem
Revision: 02
Title:    ML-KEM for HPKE
Date:     2024-10-11
Group:    Individual Submission
Pages:    7
URL:
https://www.ietf.org/archive/id/draft-connolly-cfrg-hpke-mlkem-02.txt
Status:   https://datatracker.ietf.org/doc/draft-connolly-cfrg-hpke-mlkem/
HTML:
https://www.ietf.org/archive/id/draft-connolly-cfrg-hpke-mlkem-02.html
HTMLized:
https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-hpke-mlkem
Diff:
https://author-tools.ietf.org/iddiff?url2=3Ddraft-connolly-cfrg-hpke-mlkem-=
02

Abstract:

   This memo defines ML-KEM-based ciphersuites for HPKE ([RFC9180]).
   ML-KEM is believed to be secure even against adversaries who possess
   a cryptographically-relevant quantum computer.



The IETF Secretariat

--00000000000013b275062436afe8
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello CFRG, I have published a new-new version of &#39;ML-=
KEM for HPKE&#39;:<br><br><a href=3D"https://datatracker.ietf.org/doc/draft=
-connolly-cfrg-hpke-mlkem/02/">https://datatracker.ietf.org/doc/draft-conno=
lly-cfrg-hpke-mlkem/02/</a><div><br>Previous versions used ML-KEM to craft =
an updated KDF out of HPKE&#39;s subroutines to achieve similar binding pro=
perties to the default KEM for HPKE, DHKEM. With the final publication of <=
a href=3D"https://doi.org/10.6028/nist.fips.203">FIPS 203</a>, we now have =
a better compromise: the officially FIPS-compliant 64-byte seed format of M=
L-KEM keys. This format gives us <a href=3D"https://eprint.iacr.org/2024/52=
3.pdf">MAL-BIND-K-CT and LEAK-BIND-K-PK security</a> out of the box. This s=
eems good enough for most use cases (especially inside IETF so far) and so =
I have updated my document to just say, &#39;use ML-KEM as it is, but you M=
UST use the 64-byte seed format for the keys&#39;, and that&#39;s it. Hopef=
ully you can take a look.<br><br>Thanks!<br>Deirdre<br><br><br>---------- F=
orwarded message ---------<br>From: &lt;<a href=3D"mailto:internet-drafts@i=
etf.org">internet-drafts@ietf.org</a>&gt;<br>Date: Fri, Oct 11, 2024 at 1:0=
6=E2=80=AFPM<br>Subject: New Version Notification for draft-connolly-cfrg-h=
pke-mlkem-02.txt<br>To: Deirdre Connolly &lt;<a href=3D"mailto:durumcrustul=
um@gmail.com">durumcrustulum@gmail.com</a>&gt;<br><br><br>A new version of =
Internet-Draft draft-connolly-cfrg-hpke-mlkem-02.txt has been<br>successful=
ly submitted by Deirdre Connolly and posted to the<br>IETF repository.<br><=
br>Name: =C2=A0 =C2=A0 draft-connolly-cfrg-hpke-mlkem<br>Revision: 02<br>Ti=
tle: =C2=A0 =C2=A0ML-KEM for HPKE<br>Date: =C2=A0 =C2=A0 2024-10-11<br>Grou=
p: =C2=A0 =C2=A0Individual Submission<br>Pages: =C2=A0 =C2=A07<br>URL: =C2=
=A0 =C2=A0 =C2=A0<a href=3D"https://www.ietf.org/archive/id/draft-connolly-=
cfrg-hpke-mlkem-02.txt">https://www.ietf.org/archive/id/draft-connolly-cfrg=
-hpke-mlkem-02.txt</a><br>Status: =C2=A0 <a href=3D"https://datatracker.iet=
f.org/doc/draft-connolly-cfrg-hpke-mlkem/">https://datatracker.ietf.org/doc=
/draft-connolly-cfrg-hpke-mlkem/</a><br>HTML: =C2=A0 =C2=A0 <a href=3D"http=
s://www.ietf.org/archive/id/draft-connolly-cfrg-hpke-mlkem-02.html">https:/=
/www.ietf.org/archive/id/draft-connolly-cfrg-hpke-mlkem-02.html</a><br>HTML=
ized: <a href=3D"https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-=
hpke-mlkem">https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-hpke-=
mlkem</a><br>Diff: =C2=A0 =C2=A0 <a href=3D"https://author-tools.ietf.org/i=
ddiff?url2=3Ddraft-connolly-cfrg-hpke-mlkem-02">https://author-tools.ietf.o=
rg/iddiff?url2=3Ddraft-connolly-cfrg-hpke-mlkem-02</a><br><br>Abstract:<br>=
<br>=C2=A0 =C2=A0This memo defines ML-KEM-based ciphersuites for HPKE ([RFC=
9180]).<br>=C2=A0 =C2=A0ML-KEM is believed to be secure even against advers=
aries who possess<br>=C2=A0 =C2=A0a cryptographically-relevant quantum comp=
uter.<br><br><br><br>The IETF Secretariat</div></div>

--00000000000013b275062436afe8--