[openpgp] WG: BSI view on KEM combiners

["Ehlen, Stephan" <[e-mail]>]

Fyi my answer to Kris's question; I didn't realize I was responding to him directly instead of the mailing list.

Best,
Stephan

-----Ursprüngliche Nachricht-----
Von: Ehlen, Stephan 
Gesendet: Dienstag, 30. Juli 2024 17:07
An: 'Kris Kwiatkowski' <[e-mail]>
Betreff: AW: [openpgp] BSI view on KEM combiners

Hi Kris,

the short answer to your question is probably a "yes". 

However, it depends a bit on the context and on what you mean by "BSI-approved".

The BSI technical guideline TR-02102-1 contains recommendations for cryptographic mechanisms and parameters etc. And indeed, if you want to claim that a composite/hybrid KEM is in line with our recommendations, then all components should be recommended.
In some cases, for example for certain government applications, this can be a requirement instead of just a recommendation (detailed e.g. in BSI TR-03116-x).

To cite from the technical guideline: TR-02102-1
"However, no claim is made to completeness, that means mechanisms not listed are not necessarily considered to be insecure by the BSI. Conversely, it is also wrong to conclude that cryptographic systems which only use the mechanisms recommended in this Technical Guideline as basic components are automatically secure: The requirements of the concrete application and the linking of different cryptographic and non-cryptographic mechanisms can lead to the fact that the recommendations made here cannot be implemented directly or that vulnerabilities arise."

I hope this helps a bit!?

Kind regards,
Stephan



Dr. Stephan Ehlen
____________________________________ 
Referat V 32
Bundesamt für Sicherheit in der Informationstechnik 

E-Mail:           [e-mail] 
Internet:       www.bsi.bund.de 

#DeutschlandDigitalSicherBSI

Alle Informationen zum Umgang mit Ihren personenbezogenen 
Daten finden Sie unter bsi.bund.de/datenschutz.





> -----Ursprüngliche Nachricht-----
> Von: Kris Kwiatkowski <[e-mail]>
> Gesendet: Dienstag, 23. Juli 2024 01:35
> An: [e-mail]
> Betreff: [openpgp] BSI view on KEM combiners
> 
> Hello,
> 
> Today at IETF 120, during a presentation of draft-ehlen-openpgp-nist-bp-
> comp there was a question regarding BSI’s view on KEM combiners. Section
> 3.1 of the document calls for the specification of ML-KEM+brainpool and
> ML-KEM+nist-P-XXX.
> 
> I would like to double-check - does it mean that instantiation of KEM-
> combiner will be BSI-approved only if _both_ (ECC and PQ) algorithms are
> BSI-approved?
> 
> Kind regards,
> Kris
> 
> 
> --
> Kris Kwiatkowski
> Cryptography Dev
> 
> 
> 
> 
> _______________________________________________
> openpgp mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]