1775046 - KEM API in NSS

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P3)

Description

[Goutam Tamvada]

It seems worthwhile to have a KEM API in NSS for two reasons:

1. The NIST Post-Quantum Cryptography Standardization project has stated it will soon announce its choice of KEMs for standardization [1]; at the same time, there is discussion in the TLS Working Group over how to deploy KEMs in TLS 1.3 for post-quantum confidentiality (see [2] for example).

2. The HPKE construction uses (authenticated) KEMs as a building block. See also [3].

One way to do so could be using vendor defined interfaces in PKCS#11. I'd be happy to work on this if there is interest.

[1] https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/fvnhyQ25jUg/m/Slr3bPrnBAAJ
[2] https://mailarchive.ietf.org/arch/msg/tls/9U8S7_CtCkceeuzmwOCTjMOrUf4
[3] https://bugzilla.mozilla.org/show_bug.cgi?id=1631890#c2

Comment 1

[Robert Relyea]

The osasis PKCS #11 commitee is planning on including Post quantum algorithms and would be happy to accept proposals. A couple of weeks ago I pinged the committee about preferred solution would be to add new functions. Pre-pkcs11 3.0, adding new functions in PKCS#11 was prone to compatibility issues (stomping on vendor defined functions), so the prefered method of solving these issues is reappropriating existing functions (C_DeriveKey(), for instance, would get a lot of extra work). Given that new functions are less expensive, it makes sense to have new encapsulate/decapsulate functions which follow NIST's KEM apis.

I'd be happy to review any proposals, as well as submit them to the technical committee.

bob

Comment 2

[Goutam Tamvada]

Attachment: Bug 1775046 - Added Kyber768 to FreeBL. r=jschanck

Comment 3

[Goutam Tamvada]

Attachment: Bug 1775046 - add Kyber and a PKCS#11 KEM interface to softoken. r=rrelyea

Depends on D158024

Comment 4

[Robert Relyea]

The patch is moving away from what OASIS is proposing from a mechanism perspective.

Comment 5

[Goutam Tamvada]

Attachment: Bug 1775046 - Added X25519Kyber768Draft00 KEM-based key exchange to TLS 1.3. r=jschanck,djackson

Comment 6

[John Schanck [:jschanck]]

https://hg.mozilla.org/projects/nss/rev/584f6b21513dcac8efa242e855c57f090d720d1e