Re: [lamps] Which PQC KEMs can be used for composite encryption?

[Kris Kwiatkowski <[e-mail]>]

On 9/15/21 9:02 PM, Mike Ounsworth wrote:
> But we're not sufficiently expert in KEMs to know if this applies only to some PQC KEMs, to all PQC KEMs, or all KEMs present and future.

The authors of "Separate Your Domains: NIST PQC KEMs, Oracle Cloning and 
Read-Only Indifferentiability" (Bellare, Davis, Gunther, EUROCRYPT 2020) looked
at the construction of NIST PQC KEMs. An orthogonal, but still contribution in
that paper is a "generic" framework to "unify and visualize" variations between KEM
constructions submitted to NIST PQC.
In the chapter 2.2, the "Algorithm KE_4" shows that output of a shared secret (K)
is constructed by calling random oracle H_4 and assigning it's output to K. Based
on that,  I would assume, that for all Round3 NIST PQC KEMs all bits of shared secret
are chosen uniformly.

> I am eager to hear from people more expert than myself in KEM constructions :)
Not an expert either.

BR,
Kris