Re: [CFRG] Call for adoption: Hybrid KEM Combiners

[Bas Westerbaan <[e-mail]>]

I support the CFRG working on a document that offers concrete guidance on
fashioning bespoke hybrids: there is a clear demand, and good resources are
currently lacking.

I do completely agree with Dan that we should not lose track of (at least
our) main goal: to help move everyone to a PQ/T hybrid asap.

Somewhere this year, perhaps around June, NIST will publish the final
standards for ML-KEM. That's the moment we should have a KEM ready to go —
at least for the common cases. That's the goal of X-Wing.

Nick, I would like to hear from you if you think that timeline is realistic
for the proposed document.

Best,

 Bas



On Wed, Jan 31, 2024 at 4:29 PM Nick Sullivan <[e-mail]>
wrote:

> Dear CFRG,
>
> There has been a lot of discussion on the list over the last few weeks
> around the topic of hybrid KEMs, including discussion around the topic of
> where we should go as a group. There seems to be significant interest in
> this topic from around the IETF and in broader industry. We (the chairs)
> have decided to open up a research call for adoption for a topic in this
> area, described below.
>
> The standard context for the group applies here as always: As part of the
> IRTF, the CFRG is a research group, producing research documents relevant
> to the IETF and broader community. The CFRG does *not* publish standards
> and does *not* dictate cryptographic choices to IETF working groups. CFRG
> documents often come with concrete specifications for parameterizations
> relevant to groups within the IETF. Recent examples of documents of this
> style resulting from topics adopted by the CFRG include RFC 9497 (OPRF) and
> RFC 9381 (VRF), which provide a thorough overview of the topic along with
> concrete parameterizations that can adopted by protocol designers.
>
> The CFRG has a full docket of important ongoing work, so it’s important to
> ensure that any work the CFRG adopts at this point aligns with the charter
> by offering necessary guidance (for network security in general and for the
> IETF in particular) on the use of emerging mechanisms.
>
> With that preamble done,* this email starts a three-week call for the
> adoption* of a work item within the CFRG to produce an informational
> document exploring how to safely combine KEMs. This document
> * Will use draft-ounsworth-cfrg-kem-combiners as a starting point for
> describing generic combiners
> * Will include an analysis of the non-generic combiner mechanisms for
> specific KEMs outlined in draft-connolly-cfrg-xwing-kem and other published
> works in the area
> * Will describe the security properties and trade-offs of various methods
> of combining KEMs
> * Will provide concrete instantiations of hybrid KEMs that are relevant to
> IETF protocols (potentially similar to X-Wing and Chempat-X), including
> pseudocode and test vectors
>
> Please give your views on whether this should be adopted as a CFRG draft
> and whether you would be willing to work on this document and/or review it.
>
>
> Nick, Alexey, Stanislav
> _______________________________________________
> CFRG mailing list
> [e-mail]
> https://mailman.irtf.org/mailman/listinfo/cfrg
>