[CFRG] Re: KEM combiners design team output

[Bas Westerbaan <[e-mail]>]

>
> Regarding security properties, I am particularly interested in
> authenticated KEMs. Obviously most of the discussion around PQ KEMs is
> about IND-CCA, but almost all of my use-cases want data origin
> authentication. We don’t seem to have any good candidates for PQ AKEMs,


We do have PQ AKEMs that aren't that bad today: combine any PQ KEM and PQ
signature scheme. That will do for HPKE. Signal requires a bit more than an
HPKE AKEM: they would also like to have deniability, which you don't get
when using a signature scheme instead of DH for authentication.

Best,

 Bas