[MLS] MLS Compatibility with PQC

[Alexander Sherkin <[e-mail]>]

Hello,

The current protocol draft specifically relies on Diffie-Hellman crypto primitive. This makes perfect sense when classic crypto is used, but may be a limitation when post-quantum crypto (PQC) is required.

If we assume that powerful enough quantum computers will become a reality in the next 10-15 years, any data protected with classic crypto we exchange today will be decryptable by a third party in 10-15 years. Hence, using classic crypto for new systems may not be a good idea.

At the same time, it seems that the protocol is well positioned to rely on KEM crypto primitive. Relying on KEM instead of DH allows for a wider range of options including PQC primitives such as New Hope and Crystals Kyber making the protocol PQC-ready at least from the confidentiality perspective.

To make it more general, KEM primitive may be defined as (C, s) = KEM-Encapsulate(PublicKey) and s = KEM-Decapsulate(PrivateKey, C).

Thoughts?

Thank you.
Alex.



Alexander Sherkin | Software Architect
Tel:  | Mob: [phone]
[e-mail]

The information transmitted, including attachments, is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this information.