1
$\begingroup$

In https://tools.ietf.org/id/draft-stebila-tls-hybrid-design-03.html, they define (many other sources do too) hybrid shared key exchange as

  • “Hybrid” key exchange, in this context, means the use of two (or more) key exchange algorithms based on different cryptographic assumptions, e.g., one traditional algorithm and one next-gen algorithm, with the purpose of the final session key being secure as long as at least one of the component key exchange algorithms remains unbroken. We use the term “component” algorithms to refer to the algorithms combined in a hybrid key exchange.

In Section 2 of https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf, the

  • Recommendation permits the use of a “hybrid” shared secret of the form Z′ = Z || T, a concatenation consisting of a “standard” shared secret Z that was generated during the execution of a key-establishment scheme (as currently specified in [SP 800-56A] or [SP 800-56B]) followed by an auxiliary shared secret T that has been generated using some other method.

I am confused in practice how this shared secret is supposed to be used. Is this the key that is used with AES for encryption / decryption?

If the concern is that users are worried about the Store Now / Decrypt Later vulnerability, would this mean to do AES twice using the classical and then the PQC key?

There also seems to be a Composite variant that allows n-algorithms.

Can someone please clarify how this shared key is used in practice?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

I am confused in practice how this shared secret is supposed to be used. Is this the key that is used with AES for encryption / decryption?

Indirectly; this hybrid shared secret is fed into some secure Key Derivation Function to generate the actually AES keys.

If the concern is that users are worried about the Store Now / Decrypt Later vulnerability, would this mean to do AES twice using the classical and then the PQC key?

No, you do AES only once, using a key that was generated from both the classical and the postquantum shared secrets.

Improve this answer
$\endgroup$
1
  • $\begingroup$ I'll note that you also use a KDF on the result of a pre-quantum key exchange, so this step isn't new, it just has a second input. $\endgroup$
    – SAI Peregrinus
    Jun 26, 2022 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.