Re: [Pqc] [lamps] [EXTERNAL] Re: CMS Kyber: include PK and CT in the KDF?

[Deirdre Connolly <[e-mail]>]

> The only new thing is draft-connolly-cfrg-hpke-mlkem proposing adding
some extra hashing to KEM because it does not consider IND-CCA2 to be
enough (there is now proof that IND-CCA2 is enough).

To match IND-CCA2 security of HPKE alone. There is evidence that the MAL-
bindings of DHKEM are actually desired security properties of HPKE that
came 'for free' in all the original formal analysis of HPKE, and that it
was a unfortunate mistake to not build into HPKE as part of the KeySchedule
vs purely inside DHKEM (it fixed DHKEM's IND-CCA security, but). There is
remaining work to do but, beyond matching DHKEM's MAL binding properties
because variance of expectations isn't great, I wouldn't be surprised if we
find that HPKE KEMs require X-BIND-K-PK to get implicit key authentication
in base mode, which seems table-stakes.

On Fri, Apr 12, 2024, 9:56 AM Ilari Liusvaara <[e-mail]>
wrote:

> On Fri, Apr 12, 2024 at 12:00:39PM +0530, tirumal reddy wrote:
> >
> > It would be advantageous if the cryptographic library for PQC KEMs could
> be
> > seamlessly integrated without the need to create a new mechanism within
> the
> > JOSE/COSE WGs to establish a binding of the encapsulation key and
> > ciphertext into the shared secret.
>
> That is already the case, one can just take the raw shared secret out
> of IND-CCA2 KEM (e.g., ML-KEM) and dump it into usual JOSE/COSE KDF.
> It is not difficult to show that JOSE/COSE can not take advantage of
> pk-to-ss or ct-to-ss bindings.
>
> This can be trivially extended to PQ hybrids.
>
>
> > I also see variations in the KDF usage:
> > for instance, the CMS specification utilizes KMAC, while the
> > draft-connolly-cfrg-hpke-mlkem proposes use of HKDF-Extract and
> > HKDF-Expand. We identified this challenge during our work on
> > https://datatracker.ietf.org/doc/draft-reddy-cose-jose-pqc-kem/
> > <https://datatracker.ietf.org/doc/draft-reddy-cose-jose-pqc-kem/>
>
> This is nothing new. CMS, HPKE, JOSE and COSE all have different KDFs.
> This is exactly why I complained about draft-ounsworth-cfrg-kem-combiners
> being multi-key KDF instead of KEM.
>
> The only new thing is draft-connolly-cfrg-hpke-mlkem proposing adding
> some extra hashing to KEM because it does not consider IND-CCA2 to be
> enough (there is now proof that IND-CCA2 is enough).
>
>
>
>
> -Ilari
>
> --
> Pqc mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pqc
>