[CFRG] How will Kyber be added to HPKE (9180)?

[Mike Ounsworth <[e-mail]>]

Hi CFRG!

Background: we are working to add KEM support to Certificate Management Protocol v3 (CMPv3) (draft-ietf-lamps-cmp-updates, which will eventually be 4210bis). We are planning to accomplish this by supporting HPKE (RFC 9180) as a new message protection mechanism in CMPv3 and hoping that we can inherit Kyber more-or-less for free once HPKE supports it.

Question "how": How will Kyber be added to HPKE? I assume there will be an equivalent to section 4.1 that defines KyberKEM with its own Encap(pkR), Decap(enc, skR), AuthEncap(pkR, skS), and AuthDecap(enc, skR, pkS) - ie the same interfaces as for DHKEM (4.1), but making use of Kyber internally? The Kyber2018 paper [1] figure 3 defines an authenticated Kyber exchange that looks like it should easily fit into the existing HPKE APIs. In other words, will supporting 9180 now with abstractions around those 4 functions allow for easy drop-in of Kyber later?

Question "when": is there already a draft in the pipeline for adoption? When do you expect RFC publication? Presumably not before NIST final Kyber spec?



[1]: https://ieeexplore.ieee.org/abstract/document/8406610

---
Mike Ounsworth
Software Security Architect, Entrust

Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.