Re: [CFRG] FW: [EXTERNAL] New Version Notification for draft-ounsworth-cfrg-kem-combiners-00.txt

[Mike Ounsworth <[e-mail]>]

Thank you for the review Nimrod!

I look forward to reading the discussion.


I will change the abstract from:

    RSA-KEM, ECDH, Edwards curve DH, and CRYSTALS-Kyber are shown to meet this criteria and therefore be safe to use with the simplified KEM combiner.

To:

      RSA-KEM [RFC5990], ECDH [SEC1], Edwards curve DH [RFC7748], and CRYSTALS-Kyber [I-D.cfrg-schwabe-kyber] are shown to meet this criteria, when implemented as per the listed specification, and therefore are safe to use with the simplified KEM combiner. Care should be taken with implementations that are similar but not identical to those analyzed in this document.

Is that strong enough wording?

---
Mike Ounsworth

From: Nimrod Aviram <[e-mail]>
Sent: November 26, 2022 8:18 AM
To: Mike Ounsworth <[e-mail]>
Cc: [e-mail]
Subject: Re: [CFRG] FW: [EXTERNAL] New Version Notification for draft-ounsworth-cfrg-kem-combiners-00.txt

Hi Everyone,

A few remarks off the top of my head:
- I think Douglas and myself are agreed about the facts, but politely disagree on their interpretation. There are no known attacks against this construction when the underlying hash function is collision resistant. There are also no known proofs of this construction, under any assumption. The disagreement is whether this state merits using the construction (I think not, Douglas thinks yes, and he also has good practical reasons for recommending this construction).

- "considered to be a dual PRF in practice" - I am unsure what this statement is based on. Who considers it a dual-PRF in practice?

- As referred to in this document, ECDH and Edwards curve DH indeed use a KDF internally to produce the shared secret. However, one could easily read "ECDH" and understand that to mean g^xy over the appropriate group, without using a KDF. I would suggest clarifying that somehow even in the Abstract, though I'm not sure exactly how.

best,
Nimrod


On Sat, 26 Nov 2022 at 04:25, Mike Ounsworth <Mike.Ounsworth=[e-mail]<mailto:[e-mail]>> wrote:
Hi CFRG!

How to combine the output of two KEMs into a single shared secret is coming up in a bunch of places: 1. anywhere that's doing KEM/PSK hybrids 2. anywhere that’s doing Post-Quantum / Traditional hybrid KEMs (TLS, CMS, OpenPGP, JOSE/COSE, etc), and 3. anywhere that’s trying to replace a static-static DH with KEMs needs to do a KEM in each direction and combine them (see my recent thread “How will Kyber be added to HPKE?”).

At TLS 113, Douglas Stebila presented draft-ietf-tls-hybrid-design and a discussion ensued about whether KDF( ss1 || ss2 ) is a sound choice of combiner with Stebila saying “It’s fine” and Nimrod Aviram saying “But we could do better with a real Dual PRF!”. As far as I know, this debate is unresolved, so I think we need to document the standard way of doing this with any applicable caveats because people *are* doing this. This draft hopefully is not groundbreaking, just giving us something to point at so we’re all doing it the same way.

Disclaimer: I am not a cryptographer. I would love critique (I’m willing to offer co-authorship) to tighten up the security analysis and the statements about where this construction is and is not safe to use.


---
Mike Ounsworth

-----Original Message-----
From: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Sent: November 25, 2022 8:21 PM
To: Mike Ounsworth <[e-mail]<mailto:[e-mail]>>
Subject: [EXTERNAL] New Version Notification for draft-ounsworth-cfrg-kem-combiners-00.txt

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________

A new version of I-D, draft-ounsworth-cfrg-kem-combiners-00.txt
has been successfully submitted by Mike Ounsworth and posted to the IETF repository.

Name:           draft-ounsworth-cfrg-kem-combiners
Revision:       00
Title:          Combiner function for hybrid key encapsulation mechanisms (Hybrid KEMs)
Document date:  2022-11-25
Group:          Individual Submission
Pages:          14
URL:            https://urldefense.com/v3/__https://www.ietf.org/archive/id/draft-ounsworth-cfrg-kem-combiners-00.txt__;!!FJ-Y8qCqXTj2!aPvv_rJks1wNuj0CCg60vTBx5sKodPpctz4m4qHmeEIw9ZGQiX7UPrkt6DOYBe5GmsAjyimBoUGZ2j0NzeCyjHPM6QP7PQ$<https://urldefense.com/v3/__https:/www.ietf.org/archive/id/draft-ounsworth-cfrg-kem-combiners-00.txt__;!!FJ-Y8qCqXTj2!aPvv_rJks1wNuj0CCg60vTBx5sKodPpctz4m4qHmeEIw9ZGQiX7UPrkt6DOYBe5GmsAjyimBoUGZ2j0NzeCyjHPM6QP7PQ$>
Status:         https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-ounsworth-cfrg-kem-combiners/__;!!FJ-Y8qCqXTj2!aPvv_rJks1wNuj0CCg60vTBx5sKodPpctz4m4qHmeEIw9ZGQiX7UPrkt6DOYBe5GmsAjyimBoUGZ2j0NzeCyjHPnNK1zOA$<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-ounsworth-cfrg-kem-combiners/__;!!FJ-Y8qCqXTj2!aPvv_rJks1wNuj0CCg60vTBx5sKodPpctz4m4qHmeEIw9ZGQiX7UPrkt6DOYBe5GmsAjyimBoUGZ2j0NzeCyjHPnNK1zOA$>
Htmlized:       https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/draft-ounsworth-cfrg-kem-combiners__;!!FJ-Y8qCqXTj2!aPvv_rJks1wNuj0CCg60vTBx5sKodPpctz4m4qHmeEIw9ZGQiX7UPrkt6DOYBe5GmsAjyimBoUGZ2j0NzeCyjHP6-WELQQ$<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/html/draft-ounsworth-cfrg-kem-combiners__;!!FJ-Y8qCqXTj2!aPvv_rJks1wNuj0CCg60vTBx5sKodPpctz4m4qHmeEIw9ZGQiX7UPrkt6DOYBe5GmsAjyimBoUGZ2j0NzeCyjHP6-WELQQ$>


Abstract:
   The migration to post-quantum cryptography often calls for performing
   multiple key encapsulations in parallel and then combining their
   outputs to derive a single shared secret.

   This document defines the KEM combiner KDF( H(ss1) || H(ss2) ) which
   is considered to be a dual PRF in practice, even though not provably
   secure.  This mechanism simplifies to KDF( ss1 || ss2 ) when used
   with a KEM which internally uses a KDF to produce its shared secret.
   RSA-KEM, ECDH, Edwards curve DH, and CRYSTALS-Kyber are shown to meet
   this criteria and therefore be safe to use with the simplified KEM
   combiner.




The IETF Secretariat


Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.
_______________________________________________
CFRG mailing list
[e-mail]<mailto:[e-mail]>
https://www.irtf.org/mailman/listinfo/cfrg<https://urldefense.com/v3/__https:/www.irtf.org/mailman/listinfo/cfrg__;!!FJ-Y8qCqXTj2!c7uBku2gPpFbAL8OUkdHCucUEYdhQDXuBQHPdPQJGm_OKf8GOrxNzWe_CCJcCe0u2u1t1eSVbcfXlEmHZUQCTMi5MCrM$>