[Lake] Re: Request for standardized lightweight quantum-resistant key exchange (on behalf LAKE WG)

[赵运磊 <[e-mail]>]

Just notice that LAKE has four-message variant described in Section 6.3, where Initiator sends its public-key certificate in plain in the first message. In comparison, AFS-KEX does not need to send Initiator's public-key certificate in the first round, which is sent in the third round. 




Best regards

Yunlei 







-----原始郵件-----
發件人:赵运磊 <ylzhao=[e-mail]>
發送時間:2026-09-18 07:56:27 (星期五)

收件人: 赵运磊 <ylzhao=[e-mail]>
抄送: "John Mattsson" <john.mattsson=[e-mail]>, lake <[e-mail]>, CFRG <[e-mail]>
主題: [Lake] Re: Request for standardized lightweight quantum-resistant key exchange (on behalf LAKE WG)




Dear John Preuß:

Thanks again for kind reference. I made a study of draft-ietf-lake-authkem-edhoc-00, as well as the original RFC 9528, Ephemeral Diffie-Hellman Over COSE (EDHOC). I am actually not familiar with this area.

 

Before presenting my thoughts, I first quote some statements in RFC9528.

“Important    characteristics in constrained environments are the number of round trips and protocol message sizes, which (if kept low) can contribute to good performance by enabling transport over a small number of radio frames, reducing latency due to fragmentation, duty cycles,    etc.  Another important criterion is code size, which may be    prohibitively large for certain deployments due to device   capabilities or network load during firmware updates.”

 

“A typical setting is when one of the endpoints is constrained or in a constrained network and the other endpoint is a node on the Internet (such as a mobile phone). “

 

I think our AFS-KEX well suitable for lightweight KEM-based authentication and key exchange for EDHOC. It can be easily transformed into an LAKE protocol following the paradigm described in draft-ietf-lake-authkem-edhoc-00. I would make some brief comparisons between AFS-KEX based LAKE (referred to as LAKE-AFS) and the current KEM-based LAKE (referred to as LAKE-KEM). 

 

1.      LAKE-KEM is based on the traditional FSXY structure, exchanging three KEM ciphertexts with asymmetric computation. It suffers from the KCI-type attack: if the key encapsulated SS_I or SS_R is exposed, an attacker can impersonate Responder or Initiator respectively. This KCI-type attack is particular relevant for EDHOC, as it runs for constraint IoT devices. Note that SS_I or SS_R can be pre-computed and kept for relatively long period for online authentication efficiency, which may be beneficial for constrained IoT scenarios.

2.      LAKE-AFS runs in four rounds, while LAKE-KEM runs in five rounds.

3.      LAKE-AFS exchanges two KEM ciphertexts, while three KEM ciphertexts for LAKE-KEM. That means LAKE-AFS is both more compact and more efficient than AFS-KEM, which is desirable for constrained IoT devices.

4.      AFS-KEX enjoys computational symmetry, while AKE protocols of FSXY structure are not. Computational symmetry is particularly desirable for constrained IoT devices, as Initiator and Responder can use the same code/circuit and thus essentially reduce code/circuit size.

5.      AFS-KEX was indeed designed for identity hiding. Unlike ECDH where Initiator (Alice) and Responder (Bob) use the same group and generator, for ML-KEM Alice and Bot use independent public-key matrix generated from random seeds \rho_A and \rho_B respectively.  If \rho_A=\rho_B,then AFS-KEX already supports identity hiding. For identity hiding of AFS-KEX based IKE, only \rho_A and \rho_B need to be encrypted with the encryption key $EK$. Within the structure of LAKE-KEM, \rho_B can be encrypted in the second messages. Only \rho_A is sent in plain the first message. This is the only privacy disadvantage of LAKE-AFS, as far as I can see. All other security properties of LAKE-KEM are also held by LAKE-AFS, actually even stronger security satisfied by LAKE-AFS.

 

Please let me know if I have some misunderstandings.

 

Thanks!

Yunlei

 










-----原始郵件-----
發件人:赵运磊 <ylzhao=[e-mail]>
發送時間:2026-09-17 17:50:12 (星期四)

收件人: "John Mattsson" <john.mattsson=[e-mail]>
抄送: 赵运磊 <ylzhao=[e-mail]>, lake <[e-mail]>, CFRG <[e-mail]>
主題: [Lake] Re: Request for standardized lightweight quantum-resistant key exchange (on behalf LAKE WG)




Dear John Preuß:




Thanks for your kind messages and questions. Below, following your messages I provide some quick thoughts, and will provide detailed feedback soon.










-----原始郵件-----
發件人:"John Mattsson" <john.mattsson=[e-mail]>
發送時間:2026-09-17 16:00:01 (星期四)

收件人: 赵运磊 <ylzhao=[e-mail]>, lake <[e-mail]>, CFRG <[e-mail]>
主題: [Lake] Re: Request for standardized lightweight quantum-resistant key exchange (on behalf LAKE WG)



Hi Yunlei,


Please don’t spam so many IETF lists.


LAKE WG has already discussed KEM-based authentication quite extensively for several years and has adopted the following draft.
https://datatracker.ietf.org/doc/draft-ietf-lake-authkem-edhoc/


Given this, it is somewhat surprising that LAKE is not mentioned in your paper. To my knowledge, it is currently the only active standardization effort of KEM-based authentication.


Sorry that I indeed didn't know the related drafts, and joined this mailing list not so far.  I will study the drafts and provide my feedback soon.


>a suggested solution is as follows: First, using ECDH to setup communication encryption key $EK$, due to the MTU limitation of the first two rounds of IKE. Then, using $EK$ to protect the first two rounds of AFS-KEX. Compared to using ML-KEM and MS-DSA, this could reduce about 80% communication bandwidth.


I don't think LAKE is interested in quantum-vulnerable ECDH, and LAKE is not IPsec. Moreover, setting up an encrypted channel and then performing KEM-based authentication is not a new idea.


Yes, using ECDH is tailored for post-quantum IKE, as its first round has MTU limitations. For LAKE, ECDH is really unnecessary and not recommended. 



Could you send an overview explaining whether any of the ideas in your paper could be used to improve the LAKE protocol, and in particular draft-ietf-lake-authkem-edhoc, without changing its underlying assumptions? It would be helpful to understand what is genuinely new and, importantly, what is actually applicable to LAKE.


My high-level understanding is that the main contribution of your paper is to achieve mutually authenticated key exchange with ML-KEM-based authentication using fewer flights, smaller messages, and less computation, by exploiting the additive structure of ML-KEM.


Besides above, AFS-KEX enjoys: (1) Computational symmetry, which is a desirable feature for LAKE as the same code/circuit can be used by both Initiator and Responder; (2) Stronger security against exposure of (pre-computable) states, and could be immune from KCI-type attacks as discussed in our paper.
A few questions:


* Does your approach preserve all the security properties of draft-ietf-lake-authkem-edhoc?
We will make a careful investigation, and provide feedback soon.



* Can it be implemented using a standard ML-KEM API, or does it require access to ML-KEM's internal algebraic structure?
Y
es, as far as I can see, AFS-KEX can be instantiated with the native ML-KEM without any change, and can be implemented with only ML-KEM API.



* Is the approach specific to ML-KEM, or can the same technique be applied to other KEMs?


AFS-KEX can also be instantiated  with HQC and ECDH, by exploiting addition or multiplication homomorphisms. But, as far as we know now, it cannot be instantiated directly with NTRU or MLWR-based KEMs.


* Are there any additional requirements or assumptions that must be satisfied before initiating the AKE?
No additional requirements or assumptions other than ML-KEM API and MLWE assumptions, as far as I can see.



Cheers,
John Preuß Mattsson


Thanks and best wishes
Yunlei


From: 赵运磊 <ylzhao=[e-mail]>
Date: Thursday, 17 September 2026 at 05:46
To: Renzo Navas <[e-mail]>
Cc: [e-mail] <[e-mail]>; lake <[e-mail]>; [e-mail] <[e-mail]>; cose <[e-mail]>; ace <[e-mail]>
Subject: [Lake] Re: Request for standardized lightweight quantum-resistant key exchange (on behalf LAKE WG)


| |
Some people who received this message don't often get email from ylzhao=[e-mail]. Learn why this is important
| |

Dear All:

I am Yunlei from Fudan university, Shanghai. I would draw your kind  attention on our recently published paper:Post-Quantum Internet Key Exchange via Authenticated Forward-Secure KEM (named AFS-KEX), which is available from: https://eprint.iacr.org/2026/1581




In this work, we present a novel AKE construction from KEM without using signature: more compact, more efficient,  more secure against state exposure. We hope this work is applicable to LAKE and post-quantum IKE. 




With a brief study, a suggested solution is as follows: First, using ECDH to setup communication encryption key $EK$, due to the MTU limitation of the first two rounds of IKE. Then, using $EK$ to protect the first two rounds of AFS-KEX. Compared to using ML-KEM and MS-DSA, this could reduce about 80% communication bandwidth.




Best regards

Yunlei 




-----原始郵件-----
發件人: "Renzo Navas" <[e-mail]>
發送時間: 2026-09-13 17:52:46 (星期日)
收件人: [e-mail]
抄送: lake <[e-mail]>, [e-mail], cose <[e-mail]>, ace <[e-mail]>
主題: [Lake] Request for standardized lightweight quantum-resistant key exchange (on behalf LAKE WG)




Dear CFRG,


The LAKE working group is chartered to work on a lightweight mutually authenticated key exchange protocol targeting constrained network environments such as NB-IoT, 6TiSCH, LoRaWAN, IEEE 802.15.4, and BLE. The base LAKE/EDHOC protocol (RFC 9528) is now being updated for the post-quantum setting [1].

In March 2026, the LAKE working group formed a post-quantum Design Team (DT) scoped to evaluate the constrained network scenarios where a quantum-resistant variant of LAKE is realistically deployable. DT identified that the resulting large message sizes due to current PQC algorithms are not well suited for the most constrained IoT environments [2]. At the same time, constrained IoT systems also need to migrate to post-quantum cryptography.

LAKE kindly requests CFRG to consider research and specification of lightweight quantum-resistant key exchange algorithms.


1. As shown in the analysis [2], a non-interactive key exchange (NIKE)-based approach to quantum-resistant LAKE could reduce the message size of a mutually authenticated AKE compared to KEM-based approaches, which is particularly beneficial for constrained IoT deployments. In particular, the specification of a lightweight NIKE, such as CTIDH and MIKE, would allow, for example, the deployment of quantum-resistant LAKE in network environments with Maximum Transmission Unit (MTU) of up to 127 bytes (classes S1/S2 [3]).

2. The specification of more optimized KEMs, such as lattice-based KEMs (e.g., BAT and DAWN) would also reduce the message sizes, making quantum-resistant LAKE more efficiently deployable in these constrained settings.

 

LAKE would be happy to provide further input on this topic and to evaluate candidate proposals from a performance point of view. 




Kind regards,




Renzo Navas on behalf of the LAKE WG




P.S.: I cross-post this to some WGs that might be interested in this information.

 

[1] https://datatracker.ietf.org/doc/draft-ietf-lake-pqsuites/

[2] https://datatracker.ietf.org/meeting/126/materials/slides-126-lake-08-pq-edhoc-dt-summary-ietf126presentation-00

[3] https://datatracker.ietf.org/doc/draft-ietf-iotops-7228bis/