Re: [lamps] [EXTERNAL] Re: Security Consideration for draft-turner-lamps-nist-pqc-kem-certificates

[Ilari Liusvaara <[e-mail]>]

On Fri, Mar 25, 2022 at 01:30:28PM +0000, Mike Ounsworth wrote:
> > So if your scenario envisions concatenating a traditional
> (RSA/FFDH/ECC) shared secret and a PQ shared secret, one would want
> to be sure the first component of the concatenation is not variable
> length.
> 
> Another good point!
> 
> Thinking out loud: does padding solve the problem?
> 
> H(ss_1 || ss_2 || .. || ss_n)
> 
> if ss_i are each padded / truncated to, say, the security level of
> the underlying hash function, does that work?

One could solve the issue for variable length SS by adding a length
field and padding to the maximum possible SS length. I think truncating
is a bad idea, and could interact badly with some oddball KEMs.

However, using KEMs with variable-length SS seems like a bad idea
anyway. E.g., see the TLS RACCOON attack.


-Ilari