mirror of
https://github.com/lux-apps/papers.git
synced 2026-11-03 05:07:46 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
54 lines
2.4 KiB
TeX
54 lines
2.4 KiB
TeX
\section{Hybrid Key Exchange}
|
|
|
|
\label{sec:hybrid-kex}
|
|
|
|
\subsection{Construction}
|
|
|
|
For node-to-node encrypted communication (P2P gossip, validator coordination), we
|
|
deploy a hybrid key exchange combining X25519 (ECDH on Curve25519) with ML-KEM-768
|
|
(FIPS~203, NIST security level 3)~\cite{fips203}.
|
|
|
|
\begin{definition}[Hybrid KEM]
|
|
\label{def:hybrid-kem}
|
|
Let $\textsf{X25519}$ be Diffie-Hellman key exchange on Curve25519 and $\textsf{MLKEM}$
|
|
be ML-KEM-768. The hybrid KEM is:
|
|
\begin{itemize}[leftmargin=2em]
|
|
\item $\textsf{HybKEM.KeyGen}()$: Generate $(pk_X, sk_X) \leftarrow \textsf{X25519.KeyGen}()$
|
|
and $(pk_M, sk_M) \leftarrow \textsf{MLKEM.KeyGen}()$.
|
|
Output $pk = (pk_X, pk_M)$ and $sk = (sk_X, sk_M)$.
|
|
\item $\textsf{HybKEM.Encaps}(pk)$: Compute $(ct_X, ss_X) \leftarrow \textsf{X25519.Encaps}(pk_X)$
|
|
and $(ct_M, ss_M) \leftarrow \textsf{MLKEM.Encaps}(pk_M)$.
|
|
Derive $ss = \textsf{HKDF}(ss_X \| ss_M \| ct_X \| ct_M)$.
|
|
Output $(ct_X \| ct_M, ss)$.
|
|
\item $\textsf{HybKEM.Decaps}(sk, ct)$: Parse $ct = (ct_X, ct_M)$.
|
|
Compute $ss_X \leftarrow \textsf{X25519.Decaps}(sk_X, ct_X)$ and
|
|
$ss_M \leftarrow \textsf{MLKEM.Decaps}(sk_M, ct_M)$.
|
|
Derive $ss = \textsf{HKDF}(ss_X \| ss_M \| ct_X \| ct_M)$.
|
|
Output $ss$.
|
|
\end{itemize}
|
|
\end{definition}
|
|
|
|
\subsection{Key Combiner Security}
|
|
|
|
The HKDF-based combiner includes both shared secrets \emph{and} both ciphertexts in
|
|
the key derivation. Including ciphertexts binds the derived key to the specific
|
|
exchange instance, preventing substitution attacks~\cite{rfc9180}.
|
|
|
|
\begin{theorem}[Hybrid KEM IND-CCA2 security]
|
|
\label{thm:hybrid-kem}
|
|
$\textsf{HybKEM}$ is IND-CCA2 secure if at least one of X25519 or ML-KEM-768 is
|
|
IND-CCA2 secure and HKDF is modeled as a random oracle.
|
|
\end{theorem}
|
|
|
|
\begin{proof}[Proof sketch]
|
|
Assume X25519 is broken (quantum adversary). Then $ss_X$ is known to the adversary,
|
|
but $ss_M$ remains pseudorandom (ML-KEM is IND-CCA2). The combined key
|
|
$ss = \textsf{HKDF}(ss_X \| ss_M \| \cdot)$ is pseudorandom because HKDF extracts
|
|
entropy from $ss_M$ regardless of the adversary's knowledge of $ss_X$. The symmetric
|
|
argument holds if ML-KEM is broken but X25519 remains secure.
|
|
\end{proof}
|
|
|
|
%% ========================================================================
|
|
%% 5. FORWARD SECRECY
|
|
%% ========================================================================
|