IETF Logo Mail Archive

[lamps] Re: KDF in draft-ietf-lamps-cms-kyber

"Dang, Quynh H. (Fed)" <quynh.dang@nist.gov> Mon, 23 September 2024 10:41 UTC

Return-Path: <quynh.dang@nist.gov>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 505D4C1519B6 for <spasm@ietfa.amsl.com>; Mon, 23 Sep 2024 03:41:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.707
X-Spam-Level:
X-Spam-Status: No, score=-2.707 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.148, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.453, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nist.gov
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O89A8_injcJy for <spasm@ietfa.amsl.com>; Mon, 23 Sep 2024 03:41:05 -0700 (PDT)
Received: from BY5PR09CU001.outbound.protection.outlook.com (mail-westusazon11011003.outbound.protection.outlook.com [52.101.86.3]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8CC59C1519AD for <spasm@ietf.org>; Mon, 23 Sep 2024 03:41:05 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=aVEXKYkCjQx38U6BBnGydGFfds8M9osnZZMUMtpqKWUoYSnnwNPGnBT1/mii+c1nfJSWdCf8a10USuFkq9kCYoThbOjIfjJ2kPGkTf/F5z0IDkJfxeELDaDyCN/oPJOaTKMBkHZHmdsTN/Ve6F5XfBIE8dh0D8raF+Z48n4ToHKpiai+IvdZLgXX2hCaF6uVkq2eIkvOytCIgM5YOCA6ZZDDq60DHximSBmDpx0yRE4iXtCjFUXIJCBToqSW+MHJPWEnWq5qLawvoKxpY1HXPw36JVl4ieINQJ9gEUPVRx+8KEvAjNZaBFxMJpMheESdAYG6hF8FDTXP8dDaRDg1uA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=WBRAdthff7OXucKMiYqrJJZiUH00OsD6FPB+Eqo7VMY=; b=hEUdLGOUWNnQ76EMUIlKZGWGeKWqflxN9bM/2LCVnJgp595E3fqCSnwrFxeE/NwwuTIXfXNMmp2S8pDvNwfAYCiUbntYLIc8WrroZNdtTClGPblDXtio6oKYKP3+KhLXiRAT6vv5RT6RojwWSp1H0B6+lKpEd6/lfBS7q7GQhrc1mVnMWFTe/YhRCRQdqBycU3ZzoeX7BKXm0WhR0TzmnN5uQRKME6pUoHh8t5Pto36Ul4IqrCcnFl+CWbIeBTcMk4Ueigvd6WxIOILnxYx5mCX0tBbdqro3CcTNdp1jllT945W+PPwfiTq1IBjNouMiqtEyd79SM3BbkYCqegCvsg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WBRAdthff7OXucKMiYqrJJZiUH00OsD6FPB+Eqo7VMY=; b=umHZOXUi0u0gTIfwmmz1f2k2E+iU2pN5x+CQWVWzO8rww8kADSbNUrhWzugpcYNNdaUA8XnENDh2/OIUOcaGNPuCBG1yuNl2m9vB3vx/HkzDXdb7tkF6NtGqPAfEQSvbjxB6NpOjEbWmXsrQ8+oSYvOVtHqZxwUafvOUHLU84qzxJfev/+Ze0+0+96D44Xl/hA4SYSweRXAJvCl8/a7fFod8zVn2s9HiGcEJJXJuDD8Tjd5FeOAr5yBR2PBQ7HUVBGQ83TfdtXqHyJWkKl/FArZGHIDTkDCY9LB4OMMUR2uWL/PkAVBk4rXwx0j/viUUwoPffRndaIIeiWfD3UBfRQ==
Received: from MW4PR09MB10059.namprd09.prod.outlook.com (2603:10b6:303:1fc::22) by PH8PR09MB9951.namprd09.prod.outlook.com (2603:10b6:510:188::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7982.25; Mon, 23 Sep 2024 10:41:03 +0000
Received: from MW4PR09MB10059.namprd09.prod.outlook.com ([fe80::e0a3:5842:681e:70c5]) by MW4PR09MB10059.namprd09.prod.outlook.com ([fe80::e0a3:5842:681e:70c5%3]) with mapi id 15.20.7982.022; Mon, 23 Sep 2024 10:41:03 +0000
From: "Dang, Quynh H. (Fed)" <quynh.dang@nist.gov>
To: Daniel Van Geest <daniel.vangeest=40cryptonext-security.com@dmarc.ietf.org>, LAMPS <spasm@ietf.org>
Thread-Topic: KDF in draft-ietf-lamps-cms-kyber
Thread-Index: AQHbDZqMdvhBi1xZ4kWHVgD6SkMNc7JlKoFQ
Date: Mon, 23 Sep 2024 10:41:02 +0000
Message-ID: <MW4PR09MB10059411D991FB27CCD792F4DF36F2@MW4PR09MB10059.namprd09.prod.outlook.com>
References: <022f3cd4-6b97-463e-aadc-b029a86cdb4a@cryptonext-security.com>
In-Reply-To: <022f3cd4-6b97-463e-aadc-b029a86cdb4a@cryptonext-security.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MW4PR09MB10059:EE_|PH8PR09MB9951:EE_
x-ms-office365-filtering-correlation-id: d0ab9e64-f653-44bd-1972-08dcdbbc3882
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|4022899009|1800799024|366016|38070700018;
x-microsoft-antispam-message-info: phaiUPpF1AH2vClfpcUbDb+H0kXyBjBcioNXLQu6oKwaO8ekVTCsGyaUxvWfgYudz1hBbYmkXjaTjehrtO6pi1P/QPYHawM+ZOtvHpI1vQcoDF1wmhAZfl3JtBBbmnT1w2S5O13OOND4/j4Ke7pNTg04VW/G2CYyEGvaETK7Nlh5WvLylzUHtmCiKPsUHBxsD+uszkgivGdk9GpIJzqLBFdu8iZxDvC5LfH6CmWeGBd5XlxMU028H0tttfTpqmnU8TTq1dm07or8kcUbnps3OxSV1dezR+BHTTiT7Gb72BIGOww3KbJxoaWPRto13bwynGa5pi4Rj8+cOzb0SoipO4+G4tHDh0V19HFELsSBaqqVJjiZdUyIorZWuSFmpgi4R6H3AB/ychoCRWKrzVArfrG2HUzYaSKoXMnpCr4FCYA0SxM/X1NMtRFAfvi7qM+TFM/Y2+h1zOX8Eq5P1CtO8evzB1xlrxMb66k2StCSS6wPtXPHSoK9CimLPsHE+BostUgLjaeFXmsbroWDhOo+ryDzjLCuBcodRIaGU/sCgaqVz05SULNln2b5XoSrh0oJqUF8JtuUZxPh84cp/EQEIcCiddwU8vxXulPLt7QCa1aA8ByP+zQp7I0EHFyMF+bgz5+nVO/ShhBeJnvefpHWwqzKbwbmn7ltyHXNe5olAiZ1Hmgx8fttBiwBpcyUC6TLHcsoBk2xntxfFpMrwXbePxraxil4jn/4b0vP2Lo2wW296GDnIaXbKINUqZZvhVQOE2AqyyypZt1RqzSZQJBpvSmQ0x4WM+tN+X6modrNjKjjNGYcoU1mt+wZhwBjkSjA2uJbpPRUfp5Y3b6u+e0yknP+UNWfFAezV+k4ZXVOjhN+bStOWPbg9fGg9Qmt53UTTBDYhT1opd42lB7Wp1ehjyZTaLGTJVuCsh9vn3U/KLCBymxyol5uhZfutARNVw27QSDJyCXps6bJeO4m2jAPyImC63MEOsdSdLwBOhtPKfrEfkO+2E91JzBUgb5PyRXyOK9Iu1SaHeUkvz7UncBEVVK6kRlBbJ08OyadTTlw0V/bz/GXGeQQaGZF8xoaxosU8X0viIBqK57iFr9Hbi2kNywy+DD0iydPMjqO8hDGsHvnyhjGXS1SgMyhxVf4EuCEUaY2n1j5oD12lFvn+Hg+lG78T7OSCXgbgQ59E12Mw34aEslM2ugl85/4O8kXMjbszS54/ixVFQ+PoNqFXAo5v9CHhIyUNw7JtXRbrABoxrdRwYg8UPSJelxyZFyNqVXVI4uV9Rky04ZE3dxSAsPwpJsqKuNBP2ujU9re3OhKSGjIR19N/+L4slGaXnKga+Z3d7BYGREid45H8v/y3rZ5Y80hp6EgCt5zn8Pq1MMwws2hi2NCWaI9Ph94oNWAcku8ftHiwxwILXFUCxB7MOzKyA==
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MW4PR09MB10059.namprd09.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(4022899009)(1800799024)(366016)(38070700018);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: gWQy3CsvMPP2DtTHMxisWIWpZ8whTjJA7RaV1rT5Qqo/dvu6e4nZ5YsSg8k0JfWWOJrlu3TwfSREP6xOfhAsiMmWa72Uq49hSDs1asQIz+0NI0qyLZtpmwPKXfLa/HDqObWysks5zYr2wkS6K3X93zSW2iXV3omnzaavn00of7NtmoUP0eZ8X88j4UnopuoZ9+yIRPR8Z3zlxPNM50gbM8svZxYqlboSxIriAFwX+dFhuUkFpdfzI4p2yiwJ/gVpqxPmllvaerUkhEkAdoXTxYYr1f36o7f56Nc3NLqEsMYmO9p2Q+hXiKIa2VlsAxE8xMKG1voeY2yPmQVyWer/fO8R31FmlRivrB0IHjr9duuu9Y6P0Bnb0CtYTv1ShXif0dbpZ2u6xeGoHsvSfsdzvJkNg2Fo03LEA4pGDk/VxBtl7ZchLto7AbNvqiRFSt0YcFK/YSqymTpWvOZScq5DlACU0zkjd1K18AtSUgtaxr/RBB1tfAluFIn7y1nghuXTlJbF/XQcRG9cGcTMZx8rm8+Wo1qaR3ToM4xOuIOpnS8axmsLSciRcBcF87I1d/nuVjClF8Kgs8WAdHpiuMNi2Glg22LScIlqAC0WX3qcPDNGkwaIZAaA+olVyIkfDXkJJcj7lMasAlCMtAOy2pyKyxJAy5Ht1d740qcTmknMzyH3Ge56VTNVw3Qd8xfoVYVlCx7hGbmKh5EBmc2nhqFSW5lCBZqnRpEIg5CIuvovpCDtwmXU+2AYc86C6JB+bkN7XAT3WM9jWB70hoVKXRa4AnGlja8evAprL+3f7u7TwH+06GzrkrDdgIeJaNkMLgvMDw0fxoHDg/KV02mc/TodAcBnN6oigk7Eejpw562aN1dcXKbLP7yS+V+Z3R4R1Z74+yGpcogdstgNf36mS1DU4Y+UKuW7AxRebKWob0PLs3NLMEks1yGo7zl3faXtKJq0NgIHTm8OByN1GRD2Fp0P7IzZ+GH2/uWBAwE24RWjMqdbP492GulSBKYqrfGy8sB97au475igljD0biI209XqTyuciRgb0hNyK6XgH98aUfNZngO5xeay3J5Z54oqgrEU+MtT6alsBVmeDm62EkShA51XSnNfwKQpYMXR0IhELg7wH7E8RF/WV9qes497lprU9lkQ0x1ABK1Zq22aayoV6Xy1W0pnT07tXRjVd4OhW/S66jpCKM0JNqLqyaUy7X73BSmTECjDcxfLFXbqaxRTcRu/Yvv0e4/H9Zr0M+XlP9SmgRTvpreq92YgP4MvBKpRqM+EVgqcXBBMET4RpiOHGceTaX8SrRU5v3nE2XqzjiqjLECaQ7dIweKUHPy2bvQ5R8jHpBtKq/ua1y2i5gnwhl0Ssym3dq8jLQDZ681L9YNHPgZigQFddYJ4VTvTEisLRK8mViJzlPwKuL6O/8jXEdSp1hWGDYj+HSn17DPx7fWWwEFh4ttivz0ybvtwPwYbFGW6qXCSuhJsjljoxag1r/shQqyNyb8R28aU4++3/yDeW7lSTVFXjpkJuRZnFQDR7Rb+4S3lNfsj2qVwnC0hVLPmaW42+Z6HC+Z9tHSoUfg=
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: nist.gov
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MW4PR09MB10059.namprd09.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d0ab9e64-f653-44bd-1972-08dcdbbc3882
X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Sep 2024 10:41:02.7591 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR09MB9951
Message-ID-Hash: 57DSGZ6HEKPVPV6R33FGBV5DQIU4GS3K
X-Message-ID-Hash: 57DSGZ6HEKPVPV6R33FGBV5DQIU4GS3K
X-MailFrom: quynh.dang@nist.gov
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc4
Precedence: list
Subject: [lamps] Re: KDF in draft-ietf-lamps-cms-kyber
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/aXSLgBPTX49pzo_mWE7EiADQ5oU>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

Hi Daniel and all,

The shared secret key K coming out of a ML-KEM Encap/Decap is a pseudorandom key.  So, it is pointless to run an extraction function over it before running an expansion function as the version 04 does. 

NIST might update SP 800-56C to allow the KDFs (including the HKDF with HMAC) there to derive keys from K in the future. But nothing is a sure thing before it happens. 

At this moment, if someone wants to use a NIST-compliant KDF, they can use one of the KDFs in SP 800-108 revision 1 here: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1-upd1.pdf

Regards,
Quynh. 



> -----Original Message-----
> From: Daniel Van Geest <daniel.vangeest=40cryptonext-
> security.com@dmarc.ietf.org>
> Sent: Monday, September 23, 2024 5:26 AM
> To: LAMPS <spasm@ietf.org>
> Subject: [lamps] KDF in draft-ietf-lamps-cms-kyber
> 
> Hi LAMPS,
> 
> The feedback in IETF 120 for draft-ietf-lamps-cms-kyber was to specify a single
> MTI KDF to use with ML-KEM in KEMRecipientInfo. The draft I presented
> specified that one of KMAC or HMAC with SHA2 must be implemented.
> Feedback from previous meetings was to please include HMAC with SHA2.
> 
> So, in the next version we will specify that the following KDFs MUST be
> supported:
> 
> If ML-KEM-512 is supported, HMAC with SHA2-256.
> If ML-KEM-768 is supported, HMAC with SHA2-512.
> If ML-KEM-1024 is supported, HMAC with SHA2-512.
> 
> The question for the group is whether we should just leave it that, or should
> we say something about KMAC?
> 
> For example, we could say implementations SHOULD to support KMAC.  The
> reasoning for KMAC is that it uses the same underlying Keccak primitives as
> ML-KEM.  But SHOULD seems to strong to me, I think it implies that most
> implementations would want to implement this and I don't know if that's the
> case.
> 
> Or, we could say implementations MAY support KMAC.  To me this statement
> seems meaningless because implementation may already support any
> additional KDF with KEMRecipientInfo as long as they also support the MTI
> one.
> 
> Thanks,
> Daniel Van Geest
> 
> 
> _______________________________________________
> Spasm mailing list -- spasm@ietf.org
> To unsubscribe send an email to spasm-leave@ietf.org

v2.46.0 | Report a Bug | By Email | System Status