[{"author": "John Gray", "text": "

Hello! Good morning (or evening where I am)! :)

", "time": "2026-03-17T01:01:56.000Z"}, {"author": "Lucas Prabel", "text": "

Good morning! :smiley:

", "time": "2026-03-17T01:02:43.000Z"}, {"author": "Tirumaleswar Reddy.K", "text": "

Good morning

", "time": "2026-03-17T01:02:51.000Z"}, {"author": "Deb Cooley", "text": "

nice, TY

", "time": "2026-03-17T01:02:56.000Z"}, {"author": "Michael P", "text": "

Hi everyone,
\nApologies that I'm remote for my first meeting.
\nLooking forward to supporting the WG

", "time": "2026-03-17T01:03:46.000Z"}, {"author": "Hannes Tschofenig", "text": "

Thanks for moving the COSE HPKE draft forward

", "time": "2026-03-17T01:06:03.000Z"}, {"author": "Deb Cooley", "text": "

JOSE HPKE draft?

", "time": "2026-03-17T01:06:38.000Z"}, {"author": "Peter Yee", "text": "

Can't hear him well. Mic on?

", "time": "2026-03-17T01:07:41.000Z"}, {"author": "David Waite", "text": "

can only barely hear him

", "time": "2026-03-17T01:07:45.000Z"}, {"author": "Emil Lundberg", "text": "

online can't hear Mike

", "time": "2026-03-17T01:07:45.000Z"}, {"author": "Hannes Tschofenig", "text": "

We were talking about the JOSE HPKE draft?

", "time": "2026-03-17T01:07:46.000Z"}, {"author": "Emil Lundberg", "text": "

better now

", "time": "2026-03-17T01:07:50.000Z"}, {"author": "David Waite", "text": "

:+1:

", "time": "2026-03-17T01:07:50.000Z"}, {"author": "Michael P", "text": "

That's better

", "time": "2026-03-17T01:07:52.000Z"}, {"author": "Tirumaleswar Reddy.K", "text": "

much better now.

", "time": "2026-03-17T01:07:57.000Z"}, {"author": "Peter Yee", "text": "

Now Mike is on. :D

", "time": "2026-03-17T01:07:59.000Z"}, {"author": "Carsten Bormann", "text": "

meetecho: speaker please

", "time": "2026-03-17T01:08:06.000Z"}, {"author": "David Waite", "text": "

:ocean:

", "time": "2026-03-17T01:08:12.000Z"}, {"author": "David Waite", "text": "

Christian Bormann with SPRIND had similar feedback

", "time": "2026-03-17T01:12:31.000Z"}, {"author": "Emil Lundberg", "text": "

I have read earlier versions, as Mike mentioned

", "time": "2026-03-17T01:16:43.000Z"}, {"author": "Carsten Bormann", "text": "

Something is blowing into Tiru's microphone

", "time": "2026-03-17T01:22:33.000Z"}, {"author": "Nathanael Ritz", "text": "

Sounds like he is outside

", "time": "2026-03-17T01:23:11.000Z"}, {"author": "Dennis Jackson", "text": "

Hannes, what is the positive use case over the HPKE approach?

", "time": "2026-03-17T01:36:04.000Z"}, {"author": "Hannes Tschofenig", "text": "

John gave the answer on the microphone a few minutes ago

", "time": "2026-03-17T01:37:39.000Z"}, {"author": "Deb Cooley", "text": "

But that is cose only?

", "time": "2026-03-17T01:37:55.000Z"}, {"author": "Brian Campbell", "text": "

COSE should maybe figure that out?

", "time": "2026-03-17T01:38:20.000Z"}, {"author": "John Gray", "text": "

But HPKE is more complicated to implement... this is more straight forward, so I would choose this one...

", "time": "2026-03-17T01:38:54.000Z"}, {"author": "Brian Campbell", "text": "

which, again, questions why the are unnatural bound together

", "time": "2026-03-17T01:39:27.000Z"}, {"author": "Brian Campbell", "text": "

unnaturally*

", "time": "2026-03-17T01:40:02.000Z"}, {"author": "Yaroslav Rosomakho", "text": "

The problem being is that one will not know upfront which one will the peer support. So both will be mandatory to implement to maximise compatibility

", "time": "2026-03-17T01:40:11.000Z"}, {"author": "Yaroslav Rosomakho", "text": "

Also HPKE typically comes from ready-made HPKE libraries, so I am not sure if HPKE implementation complexity argument really applies....

", "time": "2026-03-17T01:41:12.000Z"}, {"author": "Dennis Jackson", "text": "

There's pure and hybrid PQ modes for HPKE

", "time": "2026-03-17T01:41:50.000Z"}, {"author": "Dennis Jackson", "text": "

https://datatracker.ietf.org/doc/draft-ietf-hpke-pq/

", "time": "2026-03-17T01:42:00.000Z"}, {"author": "Ben S", "text": "

draft-ietf-hpke-pq-04 does request pure ML-KEM codepoints

", "time": "2026-03-17T01:42:03.000Z"}, {"author": "Jonathan Hammell", "text": "

The IANA registry is Specification Required. The JOSE Implementation Requirements column is intended to give guidance to implementors what is recommended for general applications. As Tiru noted, there are some customers that may want this, and this draft proposes registering them as Optional under this column.

", "time": "2026-03-17T01:42:15.000Z"}, {"author": "Yaroslav Rosomakho", "text": "

Non-hybrid ML-KEM codepoints for HPKE has been around for more than a year. There are implementations such as https://www.npmjs.com/package/@hpke/ml-kem

", "time": "2026-03-17T01:43:53.000Z"}, {"author": "Hannes Tschofenig", "text": "

Initially, HPKE did not support PQC algorithm. This was then added at a later stage.

", "time": "2026-03-17T01:44:21.000Z"}, {"author": "Dennis Jackson", "text": "

John: Can you clarify the complexity of HPKE? Having a bespoke mode for JOSE, rather than a standard approach used by many other WGs, seems more complex

", "time": "2026-03-17T01:45:44.000Z"}, {"author": "Hannes Tschofenig", "text": "

John is focused on the COSE version for the constrained IoT use case.

", "time": "2026-03-17T01:46:44.000Z"}, {"author": "John Preu\u00df Mattsson", "text": "

LAKE needs KEM algorithm registrations in COSE, not JOSE.

", "time": "2026-03-17T01:47:08.000Z"}, {"author": "Ben S", "text": "

More from Deb's cat please!

", "time": "2026-03-17T01:47:49.000Z"}, {"author": "Hannes Tschofenig", "text": "

:kitten:

", "time": "2026-03-17T01:47:51.000Z"}, {"author": "Deb Cooley", "text": "

He doesn't normally hop on the desk.... usually people just see his tail.

", "time": "2026-03-17T01:49:24.000Z"}, {"author": "Hannes Tschofenig", "text": "

He wanted to join the JOSE working group discussion

", "time": "2026-03-17T01:49:51.000Z"}, {"author": "Deb Cooley", "text": "

@meetecho - speaker please

", "time": "2026-03-17T01:49:59.000Z"}, {"author": "Hannes Tschofenig", "text": "

There is no linkage between this document and the previous discussion. Just for the record

", "time": "2026-03-17T01:59:51.000Z"}, {"author": "John Gray", "text": "

In regards to the composite signature algorithms, we spent 6 years debating algorithm combinations, and 4 years for composite KEM... Every time we tried to remove algorithms someone came along saying they needed that combination.. So in the end, we ended up with 18 composites signatures and 12 composite KEM... So if you are happy with a small subset, I applaud you!

", "time": "2026-03-17T02:06:36.000Z"}, {"author": "Dennis Jackson", "text": "

Profiling as narrowly as possible seems like a win.

", "time": "2026-03-17T02:15:30.000Z"}, {"author": "Dennis Jackson", "text": "

John: SHAKE256 is from the SHA-3 family

", "time": "2026-03-17T02:15:57.000Z"}, {"author": "John Gray", "text": "

Yes choices makes less work, even in the AI era! Using less tokens for your implementation is always good right?

", "time": "2026-03-17T02:16:49.000Z"}, {"author": "Mike Ounsworth", "text": "

Dennis Jackson said:

\n
\n

John: SHAKE256 is from the SHA-3 family

\n
\n

Sure, but SHAKE256 is not SHA3-256. My concern is that from a crypto library perspective, this introduces a different incompatible variant of the MLKEM768+X25519 primitive.

", "time": "2026-03-17T02:16:54.000Z"}, {"author": "Mike Ounsworth", "text": "

But I'm not 100% sure from the slides... let me take a quick look at the details.

", "time": "2026-03-17T02:17:26.000Z"}, {"author": "Dennis Jackson", "text": "

I thought HPKE used SHAKE256 already?

", "time": "2026-03-17T02:18:14.000Z"}, {"author": "Hannes Tschofenig", "text": "

Yes

", "time": "2026-03-17T02:18:21.000Z"}, {"author": "Mike Ounsworth", "text": "

... looking

", "time": "2026-03-17T02:18:26.000Z"}, {"author": "Hannes Tschofenig", "text": "

... looking as well to be 100% sure

", "time": "2026-03-17T02:19:22.000Z"}, {"author": "John Gray", "text": "

Dennis: SHAKE256 isn't the same as SHA3 (they produce different output, even if same output length is chosen).. But yes, their construction is almost the same...

", "time": "2026-03-17T02:19:36.000Z"}, {"author": "John Preu\u00df Mattsson", "text": "

ML-KEM does use SHAKE256.

", "time": "2026-03-17T02:19:57.000Z"}, {"author": "Filip Skokan", "text": "

(Turbo)SHAKE128/256 are available single-stage KDFs in HPKE

\n

aside of those 4 it's the three levels of HKDF(SHA-2)

", "time": "2026-03-17T02:20:22.000Z"}, {"author": "Hannes Tschofenig", "text": "

See SHAKE256 in https://datatracker.ietf.org/doc/html/draft-ietf-hpke-pq-04

", "time": "2026-03-17T02:20:57.000Z"}, {"author": "John Preu\u00df Mattsson", "text": "

For simplicity I think drop ChaCha and only use AES-256-GCM and SHAKE256.

\n

(Add ChaCha later if it is added as an content encryption algorithm )

", "time": "2026-03-17T02:21:03.000Z"}, {"author": "Dennis Jackson", "text": "

John Gray said:

\n
\n

Dennis: SHAKE256 isn't the same as SHA3 (they produce different output, even if same output length is chosen).. But yes, their construction is almost the same...

\n
\n

Yes, hence I said same family and not the same :-)

", "time": "2026-03-17T02:21:03.000Z"}, {"author": "John Gray", "text": "

Composite KEM uses SHA3 for the KEM Combiner KDF... Perhaps the KDF mentioned on the slide is used differently in HPKE... I have to look as well... :)

", "time": "2026-03-17T02:21:24.000Z"}, {"author": "John Gray", "text": "

Dennis... Yes, they are close siblings... :smile:

", "time": "2026-03-17T02:22:04.000Z"}, {"author": "Mike Ounsworth", "text": "

Ok: definitive answer on the SHA3 vs SHAKE256 thing:
\ndraft-ietf-hpke-pq-04 Section 5 says to use SHAKE or TurboSHAKE for the \"Single-Stage HPKE KDF\".
\nHOWEVER, Section 4 says that the definition of \"MLKEM768-P256\", \"MLKEM768-X25519\", and \"MLKEM1024-P384\" chains to draft-irtf-cfrg-concrete-hybrid-kems-02, which makes it clear that the _internal_ KDF within the hybrid KEM combiner is SHA3-256.

\n

So the answer is _both_ SHA3-256 (as the hybrid KEM combiner KDF), _and_ SHAKE256 (as the external KDF at the HPKE layer). That's good. That's how I expected it to be.

\n

Does that match other people's understanding?

", "time": "2026-03-17T02:27:12.000Z"}, {"author": "Jonathan Hammell", "text": "

Yes, that was my understanding, too.

", "time": "2026-03-17T02:28:12.000Z"}, {"author": "John Gray", "text": "

Mike, that makes sense... I figured it was probably two different layers of KDF happening! Thanks for confirming!

", "time": "2026-03-17T02:29:16.000Z"}, {"author": "Dennis Jackson", "text": "

Is there a compelling reason to tackle both COSE and JOSE in one draft?

", "time": "2026-03-17T02:31:30.000Z"}, {"author": "Hannes Tschofenig", "text": "

That was the approach so far in the group.

", "time": "2026-03-17T02:32:03.000Z"}, {"author": "Hannes Tschofenig", "text": "

See other documents -- ML-DSA, FN-DSA, SLH-DSA

", "time": "2026-03-17T02:32:51.000Z"}, {"author": "Mike Ounsworth", "text": "

@Brent Zundel I APOLOGIZE PROFUSELY FOR THE EXPLOSION OF ALGORITHM COMBINATIONS!!!

", "time": "2026-03-17T02:36:57.000Z"}, {"author": "Filip Skokan", "text": "

Tiru can you mute your mic if you're not speaking?

", "time": "2026-03-17T02:37:11.000Z"}, {"author": "Dennis Jackson", "text": "

+1 to Brent

", "time": "2026-03-17T02:37:24.000Z"}, {"author": "Deb Cooley", "text": "

wait @mike you are apologizing to him??? and not to me?

", "time": "2026-03-17T02:37:26.000Z"}, {"author": "Brian Campbell", "text": "

would like to attend but have a conflict in a diff WG

", "time": "2026-03-17T02:38:47.000Z"}, {"author": "Brian Campbell", "text": "

can you drop a link @Nick?

", "time": "2026-03-17T02:39:04.000Z"}, {"author": "John Preu\u00df Mattsson", "text": "

Yes, and cfrg-concrete-hybrid-kems internally use both SHAKE256 and SHA3-256

\n

\"with SHAKE256 as the PRG and SHA3-256 as the KDF.\"

\n

An acceptable implementation of FIPS 202 supports both.

", "time": "2026-03-17T02:40:24.000Z"}, {"author": "Michael P", "text": "

Nick's draft is here https://datatracker.ietf.org/doc/draft-sullivan-crypto-publication/

", "time": "2026-03-17T02:40:37.000Z"}, {"author": "Nick Sullivan", "text": "

https://www.ietf.org/archive/id/draft-sullivan-crypto-publication-00.html

", "time": "2026-03-17T02:40:46.000Z"}, {"author": "Mike Ounsworth", "text": "

@Deb Cooley -- in my defense, after trying (and failing) for years to :scissors: down the number of options, we did add a

\n
\n

10.3. Profiling down the number of options

\n
\n

which basically says \"Just use X-wing\", and which just so happens to align to the same 3 as the upstream CFRG draft.

\n

MLKEM768-P256
\nMLKEM768-X25519
\nMLKEM1024-P384

\n

https://datatracker.ietf.org/doc/html/draft-ietf-lamps-pq-composite-kem-12#autoid-44

", "time": "2026-03-17T02:40:56.000Z"}, {"author": "Nick Sullivan", "text": "

My document is very relevant to this conversation.

", "time": "2026-03-17T02:44:35.000Z"}, {"author": "Nick Sullivan", "text": "

Every group at the IETF is going to have this same discussion.

", "time": "2026-03-17T02:45:23.000Z"}, {"author": "Hannes Tschofenig", "text": "

Wise words from our AD

", "time": "2026-03-17T02:48:11.000Z"}, {"author": "Dennis Jackson", "text": "

Well said!

", "time": "2026-03-17T02:48:17.000Z"}, {"author": "John Preu\u00df Mattsson", "text": "

:clap: to the AD and mom

", "time": "2026-03-17T02:48:21.000Z"}, {"author": "Tirumaleswar Reddy.K", "text": "

Thanks Deb for giving the direction for the authors.

", "time": "2026-03-17T02:49:19.000Z"}]