[{"author": "Yoav Nir", "text": "

How long before some participants have no idea what those \"blue sheets\" we keep mentioning are?

", "time": "2024-07-26T20:01:56Z"}, {"author": "Mike Ounsworth", "text": "

I would be shocked if composite sigs has NO discussion.

", "time": "2024-07-26T20:03:30Z"}, {"author": "Yoav Nir", "text": "

Some of the people who might want to discuss are on planes right now.

", "time": "2024-07-26T20:05:04Z"}, {"author": "Mike Ounsworth", "text": "

Level 1 / 2: does LAMPS care about the embedded things of the world?

", "time": "2024-07-26T20:09:04Z"}, {"author": "Yoav Nir", "text": "

\"embedded\" can be a car with 4 GB of RAM, or a lightbulb with 100 KB.

", "time": "2024-07-26T20:10:27Z"}, {"author": "Mike Ounsworth", "text": "

Quynh's position is compatible with CNSA 2.0:

\n
\n

CRYSTALS-Kyber: Use Level V parameters for all classification levels.
\nCRYSTALS-Dilithium: Use Level V parameters for all classification levels.

\n
", "time": "2024-07-26T20:15:04Z"}, {"author": "Russ Housley", "text": "

Mike: Please mute when you are not talking

", "time": "2024-07-26T20:16:31Z"}, {"author": "Mike Ounsworth", "text": "

I want to make sure Tim's point makes it into the notes:
\nThe whole reason for having RSA hybrids is to help people with implementations so ancient that they never implemented ECC in order to help them bridge to PQ. Being over-prescriptive here to the point that these ancient can't use them is counter-productive.

", "time": "2024-07-26T20:17:18Z"}, {"author": "Mike Ounsworth", "text": "

RE: Brainpool. Stavros expressed his very great support for having them (comment on-list al least a year ago)

", "time": "2024-07-26T20:17:47Z"}, {"author": "Mike Ounsworth", "text": "

But we can talk to BSI folks again.

", "time": "2024-07-26T20:18:00Z"}, {"author": "Kris Kwiatkowski", "text": "

As far as I remember BSI really likes composites, so that's why brainpools are there, isn't it?

", "time": "2024-07-26T20:18:03Z"}, {"author": "Jan Klau\u00dfner", "text": "

brainpool: yes, BSi position has not changed here

", "time": "2024-07-26T20:18:23Z"}, {"author": "Mike Ounsworth", "text": "

Jan Klau\u00dfner said:

\n
\n

brainpool: yes, BSi position has not changed here

\n
\n

Jan, do you think you could bring us an authoritative opinion from BSI about the minimum set of brainpool combinations that BSI would like?

", "time": "2024-07-26T20:19:58Z"}, {"author": "Jan Klau\u00dfner", "text": "

@mike: i think I can do this

", "time": "2024-07-26T20:21:22Z"}, {"author": "Tim Hollebeek", "text": "

Thanks Jan, that would be very helpful

", "time": "2024-07-26T20:21:56Z"}, {"author": "Mike Ounsworth", "text": "

I would leave HKDF-SHA2 as optional.

", "time": "2024-07-26T20:22:04Z"}, {"author": "Mike Ounsworth", "text": "
\n

MTI: KMAC
\nOptional: HKDF-SHA2

\n
\n

probably better. And yes, we had better make sure both are FIPS-compliant.

", "time": "2024-07-26T20:24:43Z"}, {"author": "Mike Ounsworth", "text": "

Ugg, backwards.

\n
\n

MTI: HKDF-SHA2
\nOptional-but-preferred: HKDF-SHA2

\n
\n

probably better. And yes, we had better make sure both are FIPS-compliant.

", "time": "2024-07-26T20:25:34Z"}, {"author": "Mike Ounsworth", "text": "

OMG. 3rd try.

\n
\n

MTI: HKDF-SHA2
\nOptional-but-preferred: KMAC

\n
\n

probably better. And yes, we had better make sure both are FIPS-compliant.

", "time": "2024-07-26T20:26:54Z"}, {"author": "Mike Ounsworth", "text": "

I could imagine situations where a malicious client submits a CSR containing a KEM key which has been contrived to be able to later perform some kind of \"bait&switch\" re-encapsulation attacks where an honest party is no longer encrypting for the entity that they think they are.

", "time": "2024-07-26T20:30:45Z"}, {"author": "John Gray", "text": "

Thanks Jan. That would be very helpful to get a statement from BSI on which brainpool curves we have to use...

", "time": "2024-07-26T20:31:16Z"}, {"author": "Mike Ounsworth", "text": "

:thinking:
\nCan these re-encapsulation attacks allow for self-backdooring your public key so that a 3rd party monitoring agent can decrypt, but has also claim that they don't have a copy of the client's private key? :thinking:. I may have a business proposition...

", "time": "2024-07-26T20:33:25Z"}, {"author": "Daniel Van Geest", "text": "

\"MTI: HKDF-SHA2
\nOptional-but-preferred: KMAC\"
\nMTI but something else is preferred is a little odd isn't it?

", "time": "2024-07-26T20:35:20Z"}, {"author": "Britta Hale", "text": "

@Mike Ounsworth Well, that is certainly one approach, i.e., self licensing a backdoor on your own security... at least you get paid for someone attacking you. :smirk:

", "time": "2024-07-26T20:37:41Z"}, {"author": "Michael StJohns", "text": "

is outputbits part of the mixin for the KDF? or just an input to the LTRIM?

", "time": "2024-07-26T20:39:58Z"}, {"author": "Kris Kwiatkowski", "text": "

+1

", "time": "2024-07-26T20:40:49Z"}, {"author": "Sophie Schmieg", "text": "

It's a sad thing

", "time": "2024-07-26T20:40:53Z"}, {"author": "Sophie Schmieg", "text": "

Note that this would not meet the leak misbinding property, whatever that implies

", "time": "2024-07-26T20:45:37Z"}, {"author": "Peter Campbell", "text": "

Please don't call this DHKEM. It's not 9180's DHKEM.

", "time": "2024-07-26T20:45:50Z"}, {"author": "Daniel Van Geest", "text": "

DHKEM-

", "time": "2024-07-26T20:46:49Z"}, {"author": "Peter Campbell", "text": "

It might be onfusing to call it the same thing.

", "time": "2024-07-26T20:46:51Z"}, {"author": "Daniel Van Geest", "text": "

minus

", "time": "2024-07-26T20:46:56Z"}, {"author": "Kris Kwiatkowski", "text": "

KEMDH

", "time": "2024-07-26T20:47:06Z"}, {"author": "Sophie Schmieg", "text": "

ECIES

", "time": "2024-07-26T20:47:18Z"}, {"author": "Daniel Van Geest", "text": "

aren't you a smartcard vendor?

", "time": "2024-07-26T20:50:58Z"}, {"author": "Mike Ounsworth", "text": "

Did Russ say \"More time to argue about Composites\" ?

", "time": "2024-07-26T21:12:09Z"}]