[openpgp] Re: WG: BSI view on KEM combiners

[Daniel Huigens <[e-mail]>]

Hi Falko,

On Wednesday, September 4th, 2024 at 07:00, Falko Strenzke wrote:

>>
>
> Britta's concerns were formulated with respect to cryptographic mechanisms, while yours seem to be entirely with respect to parameter choices. And I cannot really see how CFRG could help us regarding the choice of parameters.

Pedantically speaking, X25519 vs ECDH-brainpoolP256r1 is not just a different parameter, it's a different algorithm. And in any case, CFRG could definitely help with defining a combination of two KEMS (both the KEM combiner and the specific component algorithms). For example, [draft-connolly-cfrg-xwing-kem](https://www.ietf.org/archive/id/draft-connolly-cfrg-xwing-kem-04.html) proposes one such combination that we could adopt wholesale in draft-ietf-openpgp-pqc (though that's a separate discussion).

Then, if CFRG also defines a combination of ML-KEM+Brainpool, perhaps we could simply add a registration to the public-key algorithms registry, with a reference to the CFRG spec, without needing any separate spec in the OpenPGP WG?

> What exact question do you suggest should be asked to CFRG? What aspect to you expect to be clarified or resolved through that?

I didn't mean to propose to ask them a question per se, but rather to inform them of the position of the BSI (given that it might have implications for the use of cryptography in all IETF protocols), and then (if they agree it's a valid concern that should be addressed in the CFRG) propose to standardize a combination of ML-KEM+Brainpool (for example), that could then be used in OpenPGP.

This way, we have a higher chance of achieving some consistency between the algorithms used across IETF protocols.

Best,
Daniel