Subject: Re: [lamps] PQC KEM algorithms in CMS - new draft RFC is available

From: "Kampanakis, Panos" <[email-masked]>
Date: Wed, 26 Jan 2022 19:14:11 +0000

Hi Julien,

Sorry for the delay.

I was of the opinion that pursuing a more modern Hybrid KEM approach would be better. I think we should move away from the RSA-KEM (RFC5990) approach and follow HPKE currently specified in CFRG https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hpke . They are similar. The basic differences are
- (EC)DH can be used as a KEM which prevents the sender for controlling the shared secret completely. ECDH is also pretty efficient.
- better key derivation with HKDF schedule (Extract-then-Expand)
- better hybrid combination for classical ECDH and PQ KEMs.
- AES-GCM instead of AES-WRAP

I am not sure if you see value or if I could change your mind on this draft. I do believe CMS would benefit from hybrid KEM for encryption that are quantum-resilient and this draft would provide that.

Rgs,
Panos

From: Spasm <[email-masked]> On Behalf Of Julien Prat
Sent: Thursday, December 2, 2021 11:26 AM
To: [email-masked]
Cc: [email-masked]
Subject: [EXTERNAL] [lamps] PQC KEM algorithms in CMS - new draft RFC is available

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.

Hi LAMPS,

A draft RFC related to the use of a Post-Quantum KEM algorithm in CMS is available here : https://datatracker.ietf.org/doc/draft-perret-prat-lamps-cms-pq-kem/
It is basically a generalization of the RSA-KEM mechanism previously defined in [RFC5652] that could be used with any KEM algorithm, including the future NIST standardized Post-Quantum KEM algorithms.

Please don't hesitate to provide some feedback and comments to improve it!

Thank you in advance for your help.

Regards,
--
Julien PRAT
Cryptologist & Lead Developer at Cryptonext Security<https://cryptonext-security.com/> [email-masked]<mailto:[email-masked]>