[lamps] Security Consideration for draft-turner-lamps-nist-pqc-kem-certificates

[Mike Ounsworth <[e-mail]>]

The comment I was going to make at the mic:

At the TLS WG this week, Douglas Stebila presented on a known issue in the hybrid KEM combiner they're proposing for TLS (draft-ietf-tls-hybrid-design): it gets into trouble if the attacker gets to play with the lengths of the shared secrets at runtime. Obvious solution: KEM codepoints need to fix the SS length in the spec so that it's not variable at runtime.

We're putting together a draft which provides essentially the same combiner for hybrid CMS content encryption (yuck terminology hell. Florence D. please save us and write a terminology draft!).
For that combiner to avoid the attack, I think we need Sean's KEM OIDs draft to fix the shared secret length for each KEM that it specifies.

So for now I think I'm just asking @Sean to throw a Security Consideration into his draft so we don't forget that it's important.

---
Mike Ounsworth
Software Security Architect, Entrust

Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.