[openpgp] Re: WG: BSI view on KEM combiners

[Daniel Huigens <[e-mail]>]

Hi Stephan,

Thanks for the detailed response!

On Monday, August 12th, 2024 at 17:28, Ehlen, Stephan wrote:
> I'm sorry, but it is not really possible to give a one-size-fits-all answer here.
> It really depends on the use-case.

Alright, I'll try to make it more concrete :)
Do you think the BSI would object to the use of ML-KEM-768 + X25519
and/or ML-KEM-1024 + X448 in OpenPGP, as proposed by [1], with a
key combiner as described in Section 4.2.2 of that document
(or a variant of it that's compliant with SP800-56C)?
Let's say the use case is encrypted email communications with the
German government, for example.

In this case, X25519/X448 is there purely as a "fallback" in case
ML-KEM turns out not to be secure. In other words, the combination is
at least as secure as using ML-KEM by itself. (IMHO, this is what
makes it a bit of a special case, e.g. it would be strange if using
ML-KEM by itself would be considered BSI-recommended and/or -approved
but ML-KEM + X25519/X448 isn't, IMO.)

Best,
Daniel

[1]: https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-pqc-04