As an example, both Classic-McEliece and Kyber KEMs produce 32 byte shared secrets. How convenient since that's exactly the size I need for an AES-256 key!
Is this safe to do? My question can be formalized into these (I believe) equivalent questions about the definition of KEMs (I'm mostly interested in NIST Round 3 PQC KEMs, but more general answers are ok too)
- Does an $X$-bit KEM shared secret contain $X$ bits of entropy?
- Are the bits of a KEM shared secret guaranteed to be IID?
- Can a KEM shared secret be used directly as a symmetric key?
Background to explain how I arrived at this question; not actually part of the question.
I am expecting the answer to be "No, you need to run the SS though a KDF", but I'm looking for citations to back that up. That would align with this answer that @poncho gave about ECDH, which would also be true of DH, but maybe those are not formally KEMs?: