Re: [Pqc] [lamps] [EXTERNAL] Re: CMS Kyber: include PK and CT in the KDF?

[Ilari Liusvaara <[e-mail]>]

On Fri, Apr 12, 2024 at 12:00:39PM +0530, tirumal reddy wrote:
> 
> It would be advantageous if the cryptographic library for PQC KEMs could be
> seamlessly integrated without the need to create a new mechanism within the
> JOSE/COSE WGs to establish a binding of the encapsulation key and
> ciphertext into the shared secret. 

That is already the case, one can just take the raw shared secret out
of IND-CCA2 KEM (e.g., ML-KEM) and dump it into usual JOSE/COSE KDF.
It is not difficult to show that JOSE/COSE can not take advantage of
pk-to-ss or ct-to-ss bindings.

This can be trivially extended to PQ hybrids.


> I also see variations in the KDF usage:
> for instance, the CMS specification utilizes KMAC, while the
> draft-connolly-cfrg-hpke-mlkem proposes use of HKDF-Extract and
> HKDF-Expand. We identified this challenge during our work on
> https://datatracker.ietf.org/doc/draft-reddy-cose-jose-pqc-kem/
> <https://datatracker.ietf.org/doc/draft-reddy-cose-jose-pqc-kem/>

This is nothing new. CMS, HPKE, JOSE and COSE all have different KDFs.
This is exactly why I complained about draft-ounsworth-cfrg-kem-combiners
being multi-key KDF instead of KEM.

The only new thing is draft-connolly-cfrg-hpke-mlkem proposing adding
some extra hashing to KEM because it does not consider IND-CCA2 to be
enough (there is now proof that IND-CCA2 is enough).




-Ilari