Re: [TLS] WGLC for draft-ietf-tls-hybrid-design

[Sofía Celi <[e-mail]>]

Dear, all,

> On 22/08/2022 14:24, Bas Westerbaan wrote:
>> Here they're speaking about adding non-FIPS PQ to a non-PQ FIPS 
>> kex,[2] but the other way around is also ok — what am I missing?
> 
> Let's assume Kyber is FIPS-approved. Indeed, you'll be able to have
> a FIPS library with Z generated by Kyber and T generated by X25519
> (but not other way around).
> As X25519 is not FIPS-approved, the lab won't be able to test it,
> hence you can't declare any security on that scheme. This will be
> reflected in the security policy (as a "non-approved algorithm, with
> no security claimed"). In theory, X25519 may produce wrong results
> and your product still gets FIPS certificate as the algorithm is
> security irrelevant. It is similar situation as we have today, but
> with Z generated by P-256 and T by Kyber.
> 
> What, I think, is more valuable for those who need FIPS, is to be
> able to have hybrid construction in which both algorithms are properly
> tested and certified by the FIPS lab.
> 
> Also, in that case, Z can be generated by either PQ or non-PQ as
> both are FIPS-approved.

I support this. I definetly support adding P256+Kyber512 (or any of the 
NIST curves + Kyber). For actual FedRAMP purposes, the most valuable 
thing, as Kris says, is to have them both being FIPS approved (and using 
a FIPS-certified implementation or sumitting it all for FIPS 
certification). Even if Kyber becaomes FIPS-approved, one will have to 
used a FIPS-certified implementation of it in other to be able to claim 
the FIPS-approved hybrid approach (and even then it depends how/where it 
is used). As far as I know, only the NIST curves are both FIPS approved 
and some of their implementations have a certification.

Thank you,

-- 
Sofía Celi
@claucece
Cryptographic research and implementation at many places, specially Brave.
Chair of hprc at IRTF and anti-fraud at W3C.
Reach me out at: [e-mail]
Website: https://sofiaceli.com/
3D0B D6E9 4D51 FBC2 CEF7  F004 C835 5EB9 42BF A1D6