Add support for mlkem768x25519 hybrid key exchange#137
Add support for mlkem768x25519 hybrid key exchange#137loganaden wants to merge 5 commits intoopeniked:masterfrom
Conversation
which resists to Quantum computers. Signed-off-by: Loganaden Velvindron <logan@cyberstorm.mu> Signed-off-by: Jaykishan Mutkawoa <jay@cyberstorm.mu> Signed-off-by: Kavish Nadan <kn@cyberstorm.mu>
Signed-off-by: Loganaden Velvindron <logan@cyberstorm.mu> Signed-off-by: Jaykishan Mutkawoa <jay@cyberstorm.mu> Signed-off-by: Kavish Nadan <kn@cyberstorm.mu>
tobhe
left a comment
tobhe
left a comment
There was a problem hiding this comment.
Thank you for the PR! Most of it already looks pretty good. I left a bunch of questions in-line.
| cp += crypto_kem_mlkem768_PUBLICKEYBYTES; | ||
| } | ||
| crypto_scalarmult_curve25519(shared, curve25519->secret, cp); | ||
| /* result is hash of concatenation of KEM key and DH shared secret */ |
There was a problem hiding this comment.
I think in the case of ML-KEM we want to include the public keys in the hash too in order to achieve something close to MAL-BIND-K-PK security as defined in https://eprint.iacr.org/2023/1933.pdf.
https://durumcrustulum.com/2024/02/24/how-to-hold-kems/ provides a good summary.
There was a problem hiding this comment.
something like
if (kemke->initiator) {
/* we generate public key */
kempub = kemke->public;
....
} else {
/* peer sends public key */
kempub = cp;
...
if ((ctx = EVP_MD_CTX_new()) == NULL ||
EVP_DigestInit_ex(ctx, EVP_sha256(), NULL) != 1 ||
EVP_DigestUpdate(ctx, kempub, ...) != 1 ||
and Tobias Heider. Signed-off-by: Loganaden Velvindron <logan@cyberstorm.mu> Signed-off-by: Jaykishan Mutkawoa <jay@cyberstorm.mu> Signed-off-by: Kavish Nadan <kn@cyberstorm.mu>
Most of the minor issues have been fixed. We are carefully looking at the last part and will push an update |
Signed-off-by: Loganaden Velvindron <logan@cyberstorm.mu> Signed-off-by: Jaykishan Mutkawoa <jay@cyberstorm.mu> Signed-off-by: Kavish Nadan <kn@cyberstorm.mu>
Signed-off-by: Loganaden Velvindron <logan@cyberstorm.mu> Signed-off-by: Jaykishan Mutkawoa <jay@cyberstorm.mu> Signed-off-by: Kavish Nadan <kn@cyberstorm.mu>
| #define KRML_NOINLINE __attribute__((noinline, unused)) | ||
| #define KRML_HOST_EPRINTF(...) | ||
| #define KRML_HOST_EXIT(x) fatal_f("internal error") | ||
| #define KRML_HOST_EXIT(x) exit(-1) |
There was a problem hiding this comment.
@mfriedl will change this. I am going to update the PR soon with one more bugfix.
|
fwiw, i've added pr #138 which binds the secret to the KEM-pubkey. it also uses the kem code directly w/o emulating the libcrypto API. |
|
thanks @mfriedl |
3 participants
which resists to Quantum computers.