search

dconnolly / draft-connolly-cfrg-xwing-kem

I-D for a general purpose KEM (key encapsulation mechanism) that includes a hash at the end
Other
5 stars 5 forks source link

Private key format #17

Open chris-wood opened 5 months ago

chris-wood commented 5 months ago

KeyGen() outputs a private key that is the concatenation of ML-KEM private key, X25519 private key, and X25519 public key. Since the private key never has to go over the wire, I wonder (a) why the spec is prescriptive about how the private key is encoded and (b) why the X25519 public key is redundantly included in the X-Wing private key. (One can recompute it as needed.)

Can we relax the spec to only specify that the actual ML-KEM and X25519 secrets are output from KeyGen, and then perhaps recommend that implementations also precompute and store the X25519 public key if desired?

bwesterb commented 5 months ago

See #8.

KeyGen() is very fast, so if you want to save storage and don't care about a little extra computation, you can go all the way and store the seed instead of the private key.

bwesterb commented 3 weeks ago

See https://github.com/dconnolly/draft-connolly-cfrg-xwing-kem/pull/19