Re: [lamps] Key Derivation in draft-ietf-lamps-cms-kemri

Russ and Mike,

Section 5.2.1 of draft-ietf-lamps-cms-kyber-01 states the following:

“If the session key obtained from the KEM algorithm is long enough to fit into the WRAP algorithm, then the KDF could be equal to the identity function.”

Given this, should the kdf and kekLength fields be OPTIONAL in KEMRecipientInfo?

Carl

From: Spasm <spasm-bounces@ietf.org> on behalf of Russ Housley <housley@vigilsec.com>
Date: Monday, January 8, 2024 at 4:02 PM
To: Daniel Van Geest <daniel.vangeest.ietf@gmail.com>
Cc: LAMPS <spasm@ietf.org>
Subject: Re: [lamps] Key Derivation in draft-ietf-lamps-cms-kemri

Daniel:

It can use an KDF, but I expect that most implementers will want to use the same KDF that was used internal to the KEM algorithm to keep the implementation small.

Russ

On Jan 8, 2024, at 3:59 PM, Daniel Van Geest <daniel.vangeest.ietf@gmail.com> wrote:

I’m implementing draft-ietf-lamps-cms-kemri and have a question about the ` kdf KeyDerivationAlgorithmIdentifier` field in KEMRecipientInfo.

Is it intended that any (IKM, L, info) KDF can be thrown there (respecting Security Considerations), or should the KEM-instantiating documents specify which KDFs to use with which KEMs.  e.g. draft-ietf-lamps-cms-kyber should specify to use id-alg-hkdf-with-sha256 with Kyber512, id-alg-hkdf-with-sha384 with Kyber768 and id-alg-hkdf-with-sha512 with Kyber1024?

If they should do this, should the kdf field for KEMRecipientInfo be parameterized by allowed KDF ids (or whatever the right ANS.1 terminology is)?

    KEMRecipientInfo ::= SEQUENCE {

        …

        kdf KeyDerivationAlgorithmIdentifier{KEY-DERIVATION, KEMRIKeyDevAlgs},

        …

    }

    KEMRIKeyDevAlgs KEY-DERIVATION ::= {kda-hkdf-with-sha256, kda-hkdf-with-sha384, kda-hkdf-with-sha512, …}

And KEM instantiating docs can add to KeyDevAlgs if needed.

Thanks,

Daniel

_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm

_______________________________________________ Spasm mailing list Spasm@ietf.org https://www.ietf.org/mailman/listinfo/spasm 