In https://tools.ietf.org/id/draft-stebila-tls-hybrid-design-03.html, they define (many other sources do too) hybrid shared key exchange as
- “Hybrid” key exchange, in this context, means the use of two (or more) key exchange algorithms based on different cryptographic assumptions, e.g., one traditional algorithm and one next-gen algorithm, with the purpose of the final session key being secure as long as at least one of the component key exchange algorithms remains unbroken. We use the term “component” algorithms to refer to the algorithms combined in a hybrid key exchange.
In Section 2 of https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Cr2.pdf, the
- Recommendation permits the use of a “hybrid” shared secret of the form Z′ = Z || T, a concatenation consisting of a “standard” shared secret Z that was generated during the execution of a key-establishment scheme (as currently specified in [SP 800-56A] or [SP 800-56B]) followed by an auxiliary shared secret T that has been generated using some other method.
I am confused in practice how this shared secret is supposed to be used. Is this the key that is used with AES for encryption / decryption?
If the concern is that users are worried about the Store Now / Decrypt Later vulnerability, would this mean to do AES twice using the classical and then the PQC key?
There also seems to be a Composite variant that allows n-algorithms.
Can someone please clarify how this shared key is used in practice?