[Lake] Re: Request for standardized lightweight quantum-resistant key exchange (on behalf LAKE WG)

[John Mattsson <[e-mail]>]

Hi Yunlei,

Please don’t spam so many IETF lists.

LAKE WG has already discussed KEM-based authentication quite extensively for several years and has adopted the following draft.
https://datatracker.ietf.org/doc/draft-ietf-lake-authkem-edhoc/

Given this, it is somewhat surprising that LAKE is not mentioned in your paper. To my knowledge, it is currently the only active standardization effort of KEM-based authentication.

>a suggested solution is as follows: First, using ECDH to setup communication encryption key $EK$, due to the MTU limitation of the first two rounds of IKE. Then, using $EK$ to protect the first two rounds of AFS-KEX. Compared to using ML-KEM and MS-DSA, this could reduce about 80% communication bandwidth.

I don't think LAKE is interested in quantum-vulnerable ECDH, and LAKE is not IPsec. Moreover, setting up an encrypted channel and then performing KEM-based authentication is not a new idea.

Could you send an overview explaining whether any of the ideas in your paper could be used to improve the LAKE protocol, and in particular draft-ietf-lake-authkem-edhoc, without changing its underlying assumptions? It would be helpful to understand what is genuinely new and, importantly, what is actually applicable to LAKE.

My high-level understanding is that the main contribution of your paper is to achieve mutually authenticated key exchange with ML-KEM-based authentication using fewer flights, smaller messages, and less computation, by exploiting the additive structure of ML-KEM.

A few questions:

* Does your approach preserve all the security properties of draft-ietf-lake-authkem-edhoc?
* Can it be implemented using a standard ML-KEM API, or does it require access to ML-KEM's internal algebraic structure?
* Is the approach specific to ML-KEM, or can the same technique be applied to other KEMs?
* Are there any additional requirements or assumptions that must be satisfied before initiating the AKE?

Cheers,
John Preuß Mattsson

From: 赵运磊 <ylzhao=[e-mail]>
Date: Thursday, 17 September 2026 at 05:46
To: Renzo Navas <[e-mail]>
Cc: [e-mail] <[e-mail]>; lake <[e-mail]>; [e-mail] <[e-mail]>; cose <[e-mail]>; ace <[e-mail]>
Subject: [Lake] Re: Request for standardized lightweight quantum-resistant key exchange (on behalf LAKE WG)

Some people who received this message don't often get email from ylzhao=[e-mail]. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>

Dear All:

I am Yunlei from Fudan university, Shanghai. I would draw your kind  attention on our recently published paper:Post-Quantum Internet Key Exchange via Authenticated Forward-Secure KEM (named AFS-KEX), which is available from: https://eprint.iacr.org/2026/1581


In this work, we present a novel AKE construction from KEM without using signature: more compact, more efficient,  more secure against state exposure. We hope this work is applicable to LAKE and post-quantum IKE.


With a brief study, a suggested solution is as follows: First, using ECDH to setup communication encryption key $EK$, due to the MTU limitation of the first two rounds of IKE. Then, using $EK$ to protect the first two rounds of AFS-KEX. Compared to using ML-KEM and MS-DSA, this could reduce about 80% communication bandwidth.


Best regards

Yunlei


-----原始郵件-----
發件人: "Renzo Navas" <[e-mail]>
發送時間: 2026-09-13 17:52:46 (星期日)
收件人: [e-mail]
抄送: lake <[e-mail]>, [e-mail], cose <[e-mail]>, ace <[e-mail]>
主題: [Lake] Request for standardized lightweight quantum-resistant key exchange (on behalf LAKE WG)


Dear CFRG,

The LAKE working group is chartered to work on a lightweight mutually authenticated key exchange protocol targeting constrained network environments such as NB-IoT, 6TiSCH, LoRaWAN, IEEE 802.15.4, and BLE. The base LAKE/EDHOC protocol (RFC 9528) is now being updated for the post-quantum setting [1].

In March 2026, the LAKE working group formed a post-quantum Design Team (DT) scoped to evaluate the constrained network scenarios where a quantum-resistant variant of LAKE is realistically deployable. DT identified that the resulting large message sizes due to current PQC algorithms are not well suited for the most constrained IoT environments [2]. At the same time, constrained IoT systems also need to migrate to post-quantum cryptography.

LAKE kindly requests CFRG to consider research and specification of lightweight quantum-resistant key exchange algorithms.

1. As shown in the analysis [2], a non-interactive key exchange (NIKE)-based approach to quantum-resistant LAKE could reduce the message size of a mutually authenticated AKE compared to KEM-based approaches, which is particularly beneficial for constrained IoT deployments. In particular, the specification of a lightweight NIKE, such as CTIDH and MIKE, would allow, for example, the deployment of quantum-resistant LAKE in network environments with Maximum Transmission Unit (MTU) of up to 127 bytes (classes S1/S2 [3]).

2. The specification of more optimized KEMs, such as lattice-based KEMs (e.g., BAT and DAWN) would also reduce the message sizes, making quantum-resistant LAKE more efficiently deployable in these constrained settings.

LAKE would be happy to provide further input on this topic and to evaluate candidate proposals from a performance point of view.

Kind regards,

Renzo Navas on behalf of the LAKE WG

P.S.: I cross-post this to some WGs that might be interested in this information.

[1] https://datatracker.ietf.org/doc/draft-ietf-lake-pqsuites/
[2] https://datatracker.ietf.org/meeting/126/materials/slides-126-lake-08-pq-edhoc-dt-summary-ietf126presentation-00
[3] https://datatracker.ietf.org/doc/draft-ietf-iotops-7228bis/