[lamps] New Version Notification for draft-ounsworth-pq-composite-kem-00

[Mike Ounsworth <[e-mail]>]

Hi LAMPS,

We have published draft-ounsworth-pq-composite-kem-00 which allows for multi-algorithm key exchanges anywhere that PKIX allows a KEM -- notably in CMS EnvelopedData (well, it doesn't allow a KEM yet, but draft-perret-prat-lamps-cms-pq-kem will fix that!).


The composite KEM draft contains two non-trivial mechanisms which will require cryptographic review:

1. Transformations KeyTrans -> KEM, and KeyAgree -> KEM so that arbitrary combinations of {KeyTrans, KeyAgree, KEM} can be combined as if they were all KEMs.

2. Combiners to combine multiple component shared secrets into a single shared secret. We originally thought we would be good with SS = KDF(SS1 || SS2) as per NIST SP 800-56Cr2, but we have since discovered that this is a hot area of academic research [Aviram2021], [Aviram2022], [Giacon2018], so we probably need something more sophisticated. We've also added a crypto-agile way of specifying the combiner so that alternates can be added in the future.



[Aviram2021]: https://github.com/nimia/kdf_public
[Aviram2022]: https://eprint.iacr.org/2022/065
[Giacon2018]: https://eprint.iacr.org/2018/024.pdf


PS -- it's an --00. I think it's currently more lines of TODO and EDNOTE than actual text. Our goal at this point is to start the discussion and to firm up the document over several versions.

---
Mike Ounsworth
Software Security Architect, Entrust

-----Original Message-----
From: [e-mail] <[e-mail]>
Sent: July 11, 2022 4:50 PM
To: John Gray <[e-mail]>; Mike Ounsworth <[e-mail]>
Subject: [EXTERNAL] New Version Notification for draft-ounsworth-pq-composite-kem-00.txt

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________

A new version of I-D, draft-ounsworth-pq-composite-kem-00.txt
has been successfully submitted by Mike Ounsworth and posted to the IETF repository.

Name:           draft-ounsworth-pq-composite-kem
Revision:       00
Title:          Composite KEM For Use In Internet PKI
Document date:  2022-07-11
Group:          Individual Submission
Pages:          24
URL:            https://urldefense.com/v3/__https://www.ietf.org/archive/id/draft-ounsworth-pq-composite-kem-00.txt__;!!FJ-Y8qCqXTj2!epQBEDwlXF5Hp-QTdUggipQT0WEULocnrOwooDAeCOfZssGzH3ReI7voPzi6X2neL37UVixX9SPSuP5QVFf8HHUmvRNK_A$
Status:         https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-ounsworth-pq-composite-kem/__;!!FJ-Y8qCqXTj2!epQBEDwlXF5Hp-QTdUggipQT0WEULocnrOwooDAeCOfZssGzH3ReI7voPzi6X2neL37UVixX9SPSuP5QVFf8HHUZYZszFg$
Htmlized:       https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/draft-ounsworth-pq-composite-kem__;!!FJ-Y8qCqXTj2!epQBEDwlXF5Hp-QTdUggipQT0WEULocnrOwooDAeCOfZssGzH3ReI7voPzi6X2neL37UVixX9SPSuP5QVFf8HHUDHx3HVQ$


Abstract:
   The migration to post-quantum cryptography is unique in the history
   of modern digital cryptography in that neither the old outgoing nor
   the new incoming algorithms are fully trusted to protect data for the
   required data lifetimes.  The outgoing algorithms, such as RSA and
   elliptic curve, may fall to quantum cryptanalysis, while the incoming
   post-quantum algorithms face uncertainty about both the underlying
   mathematics as well as hardware and software implementations that
   have not had sufficient maturing time to rule out classical
   cryptanalytic attacks and implementation bugs.

   Cautious Implementers may wish to layer cryptographic algorithms such
   that an attacker would need to break all of them in order to
   compromise the data being protected.  For digital signatures, this is
   referred to as "dual", and for encryption key establishment this as
   referred to as "hybrid".  This document, and its companions, defines
   a specific instantiation of the dual and hybrid paradigm called
   "composite" where multiple cryptographic algorithms are combined to
   form a single key, signature, or key encapsulation mechanism (KEM)
   such that they can be treated as a single atomic object at the
   protocol level.

   EDNOTE: the terms "dual" and "hybrid" are currently in flux.  We
   anticipate an Informational draft to normalize terminology, and will
   update this draft accordingly.

   This document defines a Composite key encapsulation mechanism (KEM)
   procedure, for use with Composite keys which consist of combinations
   of Encryption or KEM algorithms for each composite component
   algorithm.  This document also introduces the idea of assigning an
   Object Identifier (OID) to a shared secret combiner so that stronger
   combiners can be implemented in the future without needing to re-
   issue this specification.

   This document is intended to be coupled with the composite keys
   structure define in [I-D.ounsworth-pq-composite-keys] and the CMS
   KEM-TRANS mechanism in [I-D.perret-prat-lamps-cms-pq-kem].




The IETF Secretariat


Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.