Closed mberry closed 1 year ago
This functionality deserves to be separated out into another crate so I am going to close the issue.
Ideally, we will have some opinionated plug and play hybrid options such as kyber764x25519
and kyber1024x448
, though personally I'm coming around to the idea that a post-quantum threat model would benefit more from inverting those two ie. kyber764x448
and kyber1024x25519
. That's an interesting discussion for another day though.
Kyber should not be used by itself currently[1][2] in most cases. There's notes in the readme about this but always a chance of misuse with shiny new thing. We should have an easy to use/ hard to fuckup hybrid[3] mechanism.
The IETF TLS 1.3 draft proposal uses a simple concatenation[4]. OpenSSH currently uses concatenation then hashing for its sntrup761x25519 kem[5]. The other alternative here is xor'ing the shared secrets assuming they are the same size (a fair assumption).
I'd suggest Kyber768x25519 as an opinionated default, though it should be pluggable with other kem's as curve25519 isn't accepted by some companies/clouds/governments/standards bodies today and probably never will be.
[1] https://www.ietf.org/archive/id/draft-campagna-tls-bike-sike-hybrid-07.html
[2] https://eprint.iacr.org/2022/975.pdf
[3] https://www.ietf.org/archive/id/draft-ietf-tls-hybrid-design-04.html#section-1.2
[4] https://www.ietf.org/archive/id/draft-ietf-tls-hybrid-design-04.html#section-3
[5] https://github.com/openssh/openssh-portable/blob/master/kexsntrup761x25519.c#L103