Re: [CFRG] FW: [EXTERNAL] New Version Notification for draft-ounsworth-cfrg-kem-combiners-00.txt

Hi Everyone,

A few remarks off the top of my head:
- I think Douglas and myself are agreed about the facts, but politely
disagree on their interpretation. There are no known attacks against this
construction when the underlying hash function is collision resistant.
There are also no known proofs of this construction, under any assumption.
The disagreement is whether this state merits using the construction (I
think not, Douglas thinks yes, and he also has good practical reasons for
recommending this construction).

- "considered to be a dual PRF in practice" - I am unsure what this
statement is based on. Who considers it a dual-PRF in practice?

- As referred to in this document, ECDH and Edwards curve DH indeed use a
KDF internally to produce the shared secret. However, one could easily read
"ECDH" and understand that to mean g^xy over the appropriate group, without
using a KDF. I would suggest clarifying that somehow even in the Abstract,
though I'm not sure exactly how.

best,
Nimrod

On Sat, 26 Nov 2022 at 04:25, Mike Ounsworth <Mike.Ounsworth=
40entrust.com@dmarc.ietf.org> wrote:

> Hi CFRG!
>
> How to combine the output of two KEMs into a single shared secret is
> coming up in a bunch of places: 1. anywhere that's doing KEM/PSK hybrids 2.
> anywhere that’s doing Post-Quantum / Traditional hybrid KEMs (TLS, CMS,
> OpenPGP, JOSE/COSE, etc), and 3. anywhere that’s trying to replace a
> static-static DH with KEMs needs to do a KEM in each direction and combine
> them (see my recent thread “How will Kyber be added to HPKE?”).
>
> At TLS 113, Douglas Stebila presented draft-ietf-tls-hybrid-design and a
> discussion ensued about whether KDF( ss1 || ss2 ) is a sound choice of
> combiner with Stebila saying “It’s fine” and Nimrod Aviram saying “But we
> could do better with a real Dual PRF!”. As far as I know, this debate is
> unresolved, so I think we need to document the standard way of doing this
> with any applicable caveats because people *are* doing this. This draft
> hopefully is not groundbreaking, just giving us something to point at so
> we’re all doing it the same way.
>
> Disclaimer: I am not a cryptographer. I would love critique (I’m willing
> to offer co-authorship) to tighten up the security analysis and the
> statements about where this construction is and is not safe to use.
>
>
> ---
> Mike Ounsworth
>
> -----Original Message-----
> From: internet-drafts@ietf.org <internet-drafts@ietf.org>
> Sent: November 25, 2022 8:21 PM
> To: Mike Ounsworth <Mike.Ounsworth@entrust.com>
> Subject: [EXTERNAL] New Version Notification for
> draft-ounsworth-cfrg-kem-combiners-00.txt
>
> WARNING: This email originated outside of Entrust.
> DO NOT CLICK links or attachments unless you trust the sender and know the
> content is safe.
>
> ______________________________________________________________________
>
> A new version of I-D, draft-ounsworth-cfrg-kem-combiners-00.txt
> has been successfully submitted by Mike Ounsworth and posted to the IETF
> repository.
>
> Name:           draft-ounsworth-cfrg-kem-combiners
> Revision:       00
> Title:          Combiner function for hybrid key encapsulation mechanisms
> (Hybrid KEMs)
> Document date:  2022-11-25
> Group:          Individual Submission
> Pages:          14
> URL:
> https://urldefense.com/v3/__https://www.ietf.org/archive/id/draft-ounsworth-cfrg-kem-combiners-00.txt__;!!FJ-Y8qCqXTj2!aPvv_rJks1wNuj0CCg60vTBx5sKodPpctz4m4qHmeEIw9ZGQiX7UPrkt6DOYBe5GmsAjyimBoUGZ2j0NzeCyjHPM6QP7PQ$
> Status:
> https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-ounsworth-cfrg-kem-combiners/__;!!FJ-Y8qCqXTj2!aPvv_rJks1wNuj0CCg60vTBx5sKodPpctz4m4qHmeEIw9ZGQiX7UPrkt6DOYBe5GmsAjyimBoUGZ2j0NzeCyjHPnNK1zOA$
> Htmlized:
> https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/draft-ounsworth-cfrg-kem-combiners__;!!FJ-Y8qCqXTj2!aPvv_rJks1wNuj0CCg60vTBx5sKodPpctz4m4qHmeEIw9ZGQiX7UPrkt6DOYBe5GmsAjyimBoUGZ2j0NzeCyjHP6-WELQQ$
>
>
> Abstract:
>    The migration to post-quantum cryptography often calls for performing
>    multiple key encapsulations in parallel and then combining their
>    outputs to derive a single shared secret.
>
>    This document defines the KEM combiner KDF( H(ss1) || H(ss2) ) which
>    is considered to be a dual PRF in practice, even though not provably
>    secure.  This mechanism simplifies to KDF( ss1 || ss2 ) when used
>    with a KEM which internally uses a KDF to produce its shared secret.
>    RSA-KEM, ECDH, Edwards curve DH, and CRYSTALS-Kyber are shown to meet
>    this criteria and therefore be safe to use with the simplified KEM
>    combiner.
>
>
>
>
> The IETF Secretariat
>
>
> Any email and files/attachments transmitted with it are confidential and
> are intended solely for the use of the individual or entity to whom they
> are addressed. If this message has been sent to you in error, you must not
> copy, distribute or disclose of the information it contains. Please notify
> Entrust immediately and delete the message from your system.
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>