Re: [lamps] CMS Kyber: include PK and CT in the KDF?

[Ilari Liusvaara <[e-mail]>]

On Thu, Apr 11, 2024 at 10:30:05AM -0400, Deirdre Connolly wrote:
> Looking again at CMS Kyber
> <https://www.ietf.org/id/draft-ietf-lamps-cms-kyber-03.html>, it seems to
> not bind the encapsulation key or the KEM ciphertext anywhere in the CMS
> scheme or the KDF. To mitigate the less-than-ideal binding properties
> <https://eprint.iacr.org/2023/1933.pdf> of ML-KEM, I would consider
> including the encapsulation key and ciphertext along with the shared secret
> `ss` as input to the KDF.

What is to prevent an attacker from just replacing the recipient with
one with desired key wrapping correct CEK, complely bypassing any
binding properties of the KEM or any extra added binding?

And that seems like much easier thing to exploit than any LEAK-BIND-*,
let alone MAL-BIND-*, failures.




-Ilari