Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
If I would use two different key-agreements e.g. SIDH and ECDH how would I handle these both derived keys?
Is there a different between XOR or SHA-256 the two keys? (Would one reduce the level of security?)
Or is there another safe method?
key = SIDH ⊕ ECDH
key = SHA-256(SIDH, ECDH)
If you are doing an ECDH key agreement $[a]B = [b]A = [ab]G$, you should be hashing the ECDH shared secret to derive a key $k = H([ab]G)$ anyway instead of using $[ab]G$ directly, for various reasons. More than that, you should hash the transcript of the key agreement in too, giving $k = H([ab]G, A, B, \mathit{etc.})$. Here $H$ might be SHA-256 or HKDF-SHA256 or BLAKE2b, with inputs encoded uniquely so that two transcripts can't collide.
The same goes for essentially any fancy mathematical magic for agreeing on an element of a fancy mathemagical structure, so it applies to SIDH too. It doesn't really matter much whether you do $H(\mathit{ecdh}, \mathit{sidh}, \mathit{transcript})$ or $H\bigl(2, H(0, \mathit{ecdh}, \mathit{transcript}), H(1, \mathit{sidh}, \mathit{transcript})\bigr)$, where $\mathit{ecdh}$ and $\mathit{sidh}$ are the mathemagical elements you summoned from the ECDH and SIDH spells. What matters is mainly that you encode all of the inputs to the hashes uniquely and label each hash input uniquely with its purpose in the protocol (done here using fixed-width numbers 0, 1, 2, but could be done using, say, length-delimited strings).
